Windows EventInformation
Windows Event ID 6276 – Microsoft-Windows-Security-Auditing: Special Privileges Assigned to New Logon
Event ID 6276 records when special privileges are assigned to a user account during logon, indicating elevated access rights have been granted for the session.
