Windows EventInformation
Windows Event ID 5377 – Microsoft-Windows-Security-Auditing: Special Privileges Assigned to New Logon
Event ID 5377 records when special privileges are assigned to a new user logon session, indicating elevated access rights have been granted during authentication.
