Windows Event ID 4611 – LSA: A trusted logon process has been assigned to an authentication package

Start by examining the specific details of Event ID 4611 to understand which authentication package and logon process are involved.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4611 by right-clicking the Security log and selecting Filter Current Log
4. Enter 4611 in the Event IDs field and click OK
5. Double-click on a recent Event ID 4611 entry to view details
6. Review the General tab for authentication package name and logon process information
7. Check the Details tab for additional technical information including process IDs and package identifiers

The event details will show which authentication package was assigned a trusted logon process, helping you correlate with recent system changes or installations.

Use PowerShell to programmatically analyze Event ID 4611 occurrences and identify patterns or anomalies.

1. Open PowerShell as Administrator
2. Query recent Event ID 4611 entries:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4611} -MaxEvents 20 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

3. For detailed analysis of authentication packages:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4611} | ForEach-Object { [xml]$xml = $_.ToXml(); $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'AuthenticationPackageName'} | Select-Object '#text' }

4. Check for events in the last 24 hours:

   $StartTime = (Get-Date).AddDays(-1)
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4611; StartTime=$StartTime} | Group-Object {$_.TimeCreated.Date} | Select-Object Name, Count

5. Export results for further analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4611} -MaxEvents 100 | Export-Csv -Path "C:\Temp\Event4611_Analysis.csv" -NoTypeInformation

This PowerShell approach allows you to identify trends, unusual authentication package assignments, or correlate events with system changes.

Examine the registry to understand which authentication packages are configured and validate their legitimacy.

1. Open Registry Editor by pressing Win + R, typing regedit, and pressing Enter
2. Navigate to the LSA authentication packages key:
   HKLM\SYSTEM\CurrentControlSet\Control\Lsa
3. Examine the Authentication Packages value to see configured authentication DLLs
4. Check the Security Packages value for additional security providers
5. Verify each listed package exists in the system directory:

   $AuthPackages = (Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "Authentication Packages")."Authentication Packages"
   foreach ($package in $AuthPackages) {
       $path = "$env:SystemRoot\System32\$package.dll"
       if (Test-Path $path) {
           Get-ItemProperty $path | Select-Object Name, VersionInfo
       } else {
           Write-Warning "Package $package.dll not found"
       }
   }

6. For notification packages, check:
   HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages

Investigate the health and configuration of authentication-related Windows services that trigger Event ID 4611.

1. Check critical authentication services status:

   $AuthServices = @('LanmanServer', 'LanmanWorkstation', 'Netlogon', 'NTDS', 'KDC')
   foreach ($service in $AuthServices) {
       try {
           Get-Service -Name $service -ErrorAction Stop | Select-Object Name, Status, StartType
       } catch {
           Write-Host "Service $service not found (normal on workstations)" -ForegroundColor Yellow
       }
   }

2. Review service dependencies that might affect authentication:

   Get-Service -Name 'LanmanServer' | Select-Object -ExpandProperty ServicesDependedOn

3. Check for recent service restarts in System log:

   Get-WinEvent -FilterHashtable @{LogName='System'; Id=7036; StartTime=(Get-Date).AddHours(-24)} | Where-Object {$_.Message -match 'authentication|logon|security'} | Format-Table TimeCreated, Message -Wrap

4. Verify domain controller connectivity (domain-joined systems):

   nltest /dsgetdc:$env:USERDNSDOMAIN

5. Test authentication package functionality:

   klist tickets

This method helps identify service-related issues that might cause abnormal authentication package assignments or failures.

Configure advanced auditing to gain deeper insights into authentication package behavior and potential security concerns.

1. Enable detailed LSA auditing using Group Policy or auditpol:

   auditpol /set /subcategory:"Other Logon/Logoff Events" /success:enable /failure:enable

2. Enable authentication policy change auditing:

   auditpol /set /subcategory:"Authentication Policy Change" /success:enable /failure:enable

3. Check current audit policy settings:

   auditpol /get /category:"Logon/Logoff"

4. Monitor for suspicious authentication package installations by creating a custom event log filter:

   $Query = @"
   
     
       *[System[EventID=4611] and EventData[Data[@Name='AuthenticationPackageName'] and (contains(., 'unknown') or contains(., 'custom'))]]
     
   
   "@
   Get-WinEvent -FilterXml $Query

5. Create a scheduled task to monitor unusual authentication package assignments:

   $Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-Command Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4611; StartTime=(Get-Date).AddMinutes(-5)} | Out-File C:\Logs\Auth_Monitor.log -Append"
   $Trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 5)
   Register-ScheduledTask -TaskName "AuthPackageMonitor" -Action $Action -Trigger $Trigger -Description "Monitor Event ID 4611 for security analysis"