Windows Event ID 4609 – Security: Windows is Starting Up

Open Event Viewer to examine Event ID 4609 details and verify normal system startup patterns.

1. Press Windows + R, type eventvwr.msc, and press Enter
2. Navigate to Windows Logs → Security
3. In the Actions pane, click Filter Current Log
4. Enter 4609 in the Event IDs field and click OK
5. Double-click any Event ID 4609 entry to view details
6. Check the General tab for timestamp and basic information
7. Review the Details tab for XML data structure

Use PowerShell to retrieve and analyze Event ID 4609 entries for pattern analysis and reporting.

1. Open PowerShell as Administrator
2. Query recent startup events:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4609} -MaxEvents 20 | Format-Table TimeCreated, Id, LevelDisplayName

3. Get startup events from the last 30 days:

   $StartDate = (Get-Date).AddDays(-30)
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4609; StartTime=$StartDate} | Select-Object TimeCreated, @{Name='BootTime';Expression={$_.TimeCreated}}

4. Export startup history to CSV:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4609} -MaxEvents 100 | Select-Object TimeCreated, MachineName | Export-Csv -Path "C:\Temp\StartupHistory.csv" -NoTypeInformation

5. Calculate average time between restarts:

   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4609} -MaxEvents 10
   $Intervals = for($i=0; $i -lt ($Events.Count-1); $i++) {
       ($Events[$i].TimeCreated - $Events[$i+1].TimeCreated).TotalHours
   }
   $AverageUptime = ($Intervals | Measure-Object -Average).Average
   Write-Host "Average uptime: $([math]::Round($AverageUptime, 2)) hours"

Ensure proper audit policy configuration to guarantee Event ID 4609 generation and optimize security logging.

1. Open Group Policy Editor by pressing Windows + R, typing gpedit.msc
2. Navigate to Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration
3. Expand System Audit Policies → System
4. Double-click Audit Security System Extension
5. Check Configure the following audit events and select Success
6. Apply the policy and run gpupdate /force
7. Verify audit settings with PowerShell:

   auditpol /get /category:"System" /r | findstr "Security System Extension"

8. Test by restarting the system and confirming Event ID 4609 appears in Security log

Implement PowerShell monitoring to track system startup patterns and detect anomalies automatically.

1. Create a monitoring script directory:

   New-Item -Path "C:\Scripts\StartupMonitor" -ItemType Directory -Force

2. Create the monitoring script C:\Scripts\StartupMonitor\Monitor-Startup.ps1:

   # Startup Monitoring Script
   $LogPath = "C:\Scripts\StartupMonitor\startup-log.txt"
   $LastBoot = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4609} -MaxEvents 1
   $BootTime = $LastBoot.TimeCreated
   $Uptime = (Get-Date) - $BootTime
   
   $LogEntry = "$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss'): Boot at $BootTime, Uptime: $($Uptime.Days)d $($Uptime.Hours)h $($Uptime.Minutes)m"
   Add-Content -Path $LogPath -Value $LogEntry
   
   # Check for unexpected restarts (less than 1 hour uptime)
   if ($Uptime.TotalHours -lt 1) {
       Write-EventLog -LogName Application -Source "StartupMonitor" -EventId 1001 -EntryType Warning -Message "Unexpected restart detected. Boot time: $BootTime"
   }

3. Register the script as a scheduled task:

   $Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-ExecutionPolicy Bypass -File C:\Scripts\StartupMonitor\Monitor-Startup.ps1"
   $Trigger = New-ScheduledTaskTrigger -AtStartup
   $Principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount
   Register-ScheduledTask -TaskName "StartupMonitor" -Action $Action -Trigger $Trigger -Principal $Principal

4. Create custom event source for logging:

   New-EventLog -LogName Application -Source "StartupMonitor"

Configure advanced logging and SIEM integration for enterprise-level startup monitoring and security analysis.

1. Enable Windows Event Forwarding for centralized collection:

   wecutil qc /q
   winrm quickconfig -q

2. Create custom XML query for Event ID 4609 forwarding:

   <QueryList>
     <Query Id="0" Path="Security">
       <Select Path="Security">*[System[EventID=4609]]</Select>
     </Query>
   </QueryList>

3. Configure WinLogBeat for Elastic Stack integration by editing winlogbeat.yml:

   winlogbeat.event_logs:
     - name: Security
       event_id: 4609
       processors:
         - add_host_metadata:
             when.not.contains.tags: forwarded

4. Set up PowerShell forensic analysis script:

   # Forensic Startup Analysis
   $StartupEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4609} -MaxEvents 50
   $ShutdownEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4608} -MaxEvents 50
   
   # Correlate startup/shutdown pairs
   $BootCycles = @()
   foreach ($Startup in $StartupEvents) {
       $PriorShutdown = $ShutdownEvents | Where-Object {$_.TimeCreated -lt $Startup.TimeCreated} | Select-Object -First 1
       if ($PriorShutdown) {
           $DownTime = ($Startup.TimeCreated - $PriorShutdown.TimeCreated).TotalMinutes
           $BootCycles += [PSCustomObject]@{
               ShutdownTime = $PriorShutdown.TimeCreated
               StartupTime = $Startup.TimeCreated
               DowntimeMinutes = [math]::Round($DownTime, 2)
           }
       }
   }
   $BootCycles | Export-Csv -Path "C:\Temp\BootCycleAnalysis.csv" -NoTypeInformation

5. Create alerting rules for anomalous patterns:

   # Alert on frequent restarts (more than 3 in 24 hours)
   $RecentStarts = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4609; StartTime=(Get-Date).AddHours(-24)}
   if ($RecentStarts.Count -gt 3) {
       Send-MailMessage -To "admin@company.com" -Subject "Frequent Restart Alert" -Body "System has restarted $($RecentStarts.Count) times in 24 hours" -SmtpServer "smtp.company.com"
   }