Windows Event ID 4672 – Security: Special Privileges Assigned to New Logon

Start by examining the specific privileges assigned and correlating with the logon session:

1. Open Event Viewer → Windows Logs → Security
2. Filter for Event ID 4672 using the filter option
3. Double-click the event to view detailed information
4. Note the Logon ID field - this correlates with Event ID 4624
5. Review the Privileges section to see which special rights were assigned
6. Check the Account Name and Account Domain fields
7. Cross-reference the timestamp with other security events

Look for unusual privilege assignments or accounts that shouldn't have elevated rights. The Logon ID allows you to trace the complete session from authentication through privilege usage.

Use PowerShell to analyze 4672 events and correlate with logon events:

# Get recent 4672 events with details
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4672} -MaxEvents 50 | 
  Select-Object TimeCreated, @{Name='Account';Expression={$_.Properties[1].Value}}, 
  @{Name='LogonID';Expression={$_.Properties[3].Value}}, 
  @{Name='Privileges';Expression={$_.Properties[4].Value}}

# Correlate with logon events (4624)
$LogonEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} -MaxEvents 100
$PrivEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4672} -MaxEvents 100

# Match by Logon ID
$LogonEvents | ForEach-Object {
  $LogonID = $_.Properties[7].Value
  $MatchingPriv = $PrivEvents | Where-Object {$_.Properties[3].Value -eq $LogonID}
  if ($MatchingPriv) {
    [PSCustomObject]@{
      Time = $_.TimeCreated
      Account = $_.Properties[5].Value
      LogonType = $_.Properties[8].Value
      Privileges = $MatchingPriv.Properties[4].Value
    }
  }
}

This correlation reveals which accounts are receiving elevated privileges and through what logon methods.

Create targeted monitoring for sensitive privilege assignments:

# Monitor for dangerous privileges
$DangerousPrivs = @('SeDebugPrivilege', 'SeBackupPrivilege', 'SeRestorePrivilege', 
                    'SeTakeOwnershipPrivilege', 'SeLoadDriverPrivilege')

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4672} -MaxEvents 200 | 
  Where-Object {
    $PrivilegeText = $_.Properties[4].Value
    $DangerousPrivs | Where-Object {$PrivilegeText -like "*$_*"}
  } | Select-Object TimeCreated, 
    @{Name='Account';Expression={$_.Properties[1].Value}}, 
    @{Name='Domain';Expression={$_.Properties[2].Value}}, 
    @{Name='Privileges';Expression={$_.Properties[4].Value}}

# Set up continuous monitoring
Register-WinEvent -Query "*[System[EventID=4672]]" -Action {
  $Event = $Event.SourceEventArgs.NewEvent
  $Account = $Event.Properties[1].Value
  $Privileges = $Event.Properties[4].Value
  
  if ($Privileges -match 'SeDebugPrivilege|SeBackupPrivilege') {
    Write-Host "ALERT: Sensitive privilege assigned to $Account at $(Get-Date)" -ForegroundColor Red
  }
}

This approach focuses on the most security-sensitive privileges that could indicate compromise or policy violations.

Check Group Policy and local security policies that grant special privileges:

1. Open Local Security Policy (secpol.msc) or Group Policy Management
2. Navigate to Computer Configuration → Windows Settings → Security Settings → Local Policies → User Rights Assignment
3. Review policies like:
• Log on as a service (SeServiceLogonRight)
• Back up files and directories (SeBackupPrivilege)
• Debug programs (SeDebugPrivilege)
• Load and unload device drivers (SeLoadDriverPrivilege)
4. Check which accounts or groups are assigned these rights
5. Use PowerShell to audit current assignments:

# Export current user rights assignments
secedit /export /cfg C:\temp\current_rights.inf
Get-Content C:\temp\current_rights.inf | Select-String "Se.*Privilege"

# Check specific privilege assignments
whoami /priv

# For remote systems
Invoke-Command -ComputerName SERVER01 -ScriptBlock {
  secedit /export /cfg C:\temp\rights.inf
  Get-Content C:\temp\rights.inf | Select-String "SeBackupPrivilege|SeDebugPrivilege"
}

Compare the policy assignments with the accounts generating 4672 events to identify unauthorized privilege grants.

Perform comprehensive analysis for security investigations:

# Create privilege assignment baseline
$BaselineDate = (Get-Date).AddDays(-30)
$Baseline = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4672; StartTime=$BaselineDate} | 
  Group-Object @{Expression={$_.Properties[1].Value + ':' + $_.Properties[4].Value}} | 
  Select-Object Name, Count

# Compare current activity to baseline
$Recent = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4672} -MaxEvents 500 | 
  Group-Object @{Expression={$_.Properties[1].Value + ':' + $_.Properties[4].Value}} | 
  Select-Object Name, Count

# Identify anomalies
$Anomalies = Compare-Object $Baseline $Recent -Property Name -IncludeEqual | 
  Where-Object {$_.SideIndicator -eq '=>'}

if ($Anomalies) {
  Write-Host "New privilege assignments detected:" -ForegroundColor Yellow
  $Anomalies | ForEach-Object {Write-Host $_.Name -ForegroundColor Red}
}

# Deep dive analysis
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4672} -MaxEvents 1000 | 
  ForEach-Object {
    [PSCustomObject]@{
      Time = $_.TimeCreated
      Account = $_.Properties[1].Value
      Domain = $_.Properties[2].Value
      LogonID = $_.Properties[3].Value
      PrivilegeCount = ($_.Properties[4].Value -split '\r\n' | Measure-Object).Count
      HasDebugPriv = $_.Properties[4].Value -like '*SeDebugPrivilege*'
      HasBackupPriv = $_.Properties[4].Value -like '*SeBackupPrivilege*'
    }
  } | Export-Csv -Path "C:\temp\privilege_analysis.csv" -NoTypeInformation

This method establishes normal privilege assignment patterns and identifies deviations that may indicate security issues or policy changes.