Windows Event ID 4699 – Security: A Token Right Was Adjusted

Start by reviewing the specific details of Event ID 4699 to understand what privilege was adjusted and for which account.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4699 by right-clicking the Security log and selecting Filter Current Log
4. Enter 4699 in the Event IDs field and click OK
5. Double-click on a 4699 event to view detailed information including:
   • Subject account name and domain
   • Target account for privilege adjustment
   • Specific privileges that were modified
   • Process name and ID responsible for the change
   • Logon ID linking to related authentication events
6. Cross-reference the Logon ID with Event ID 4624 (successful logon) to understand the full context

Use PowerShell to analyze Event ID 4699 patterns and identify unusual privilege adjustment activities.

1. Open PowerShell as Administrator
2. Query recent Event ID 4699 entries:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4699} -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message

3. Filter events by specific user accounts:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4699} | Where-Object {$_.Message -like "*username*"} | Select-Object TimeCreated, Message

4. Analyze privilege adjustment frequency by hour:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4699} -MaxEvents 1000 | Group-Object {$_.TimeCreated.Hour} | Sort-Object Name

5. Export events for detailed analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4699} | Export-Csv -Path "C:\temp\Event4699_Analysis.csv" -NoTypeInformation

6. Search for specific privilege types:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4699} | Where-Object {$_.Message -like "*SeDebugPrivilege*"}

Investigate the broader context by correlating Event ID 4699 with related security events to understand the complete privilege adjustment scenario.

1. Identify the Process ID from the Event ID 4699 details
2. Search for process creation events (Event ID 4688) with matching Process ID:

   $ProcessID = "1234"  # Replace with actual PID from Event 4699
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} | Where-Object {$_.Message -like "*$ProcessID*"}

3. Find related logon events using the Logon ID:

   $LogonID = "0x12345"  # Replace with actual Logon ID from Event 4699
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4625} | Where-Object {$_.Message -like "*$LogonID*"}

4. Check for UAC elevation events (Event ID 4672) that might be related:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4672} | Where-Object {$_.TimeCreated -gt (Get-Date).AddHours(-1)}

5. Review Group Policy application events if privilege changes seem policy-related:

   Get-WinEvent -FilterHashtable @{LogName='System'; Id=1502,1503}

6. Create a timeline view of related events:

   $StartTime = (Get-Date).AddHours(-2)
   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4699,4688,4624,4672; StartTime=$StartTime}
   $Events | Sort-Object TimeCreated | Select-Object TimeCreated, Id, Message

Set up comprehensive monitoring for privilege adjustments to detect security issues and maintain compliance.

1. Enable detailed privilege use auditing through Group Policy:
   • Open Group Policy Management Console
   • Navigate to Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration
   • Expand Privilege Use and configure Audit Sensitive Privilege Use
2. Configure registry settings for enhanced privilege auditing:

   Set-ItemProperty -Path "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" -Name "FullPrivilegeAuditing" -Value 1 -Type DWord

3. Set up Windows Event Forwarding for centralized collection:

   wecutil cs subscription.xml  # After creating appropriate subscription XML

4. Create custom Event Viewer views for Event ID 4699 monitoring:
   • In Event Viewer, right-click Custom Views and select Create Custom View
   • Set Event IDs to 4699 and configure additional filters as needed
5. Configure PowerShell scheduled task for regular analysis:

   $Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\Analyze4699Events.ps1"
   $Trigger = New-ScheduledTaskTrigger -Daily -At "06:00AM"
   Register-ScheduledTask -TaskName "Event4699Analysis" -Action $Action -Trigger $Trigger

Perform thorough security analysis when Event ID 4699 indicates potential privilege abuse or unauthorized access attempts.

1. Analyze privilege escalation patterns using advanced PowerShell queries:

   $SuspiciousPrivileges = @("SeDebugPrivilege", "SeTakeOwnershipPrivilege", "SeLoadDriverPrivilege")
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4699} | Where-Object {
       $Message = $_.Message
       $SuspiciousPrivileges | Where-Object {$Message -like "*$_*"}
   }

2. Check for privilege adjustments outside business hours:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4699} | Where-Object {
       $_.TimeCreated.Hour -lt 6 -or $_.TimeCreated.Hour -gt 22
   } | Select-Object TimeCreated, Message

3. Investigate user accounts with frequent privilege adjustments:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4699} -MaxEvents 1000 | ForEach-Object {
       if ($_.Message -match "Account Name:\s+([^\r\n]+)") {
           $matches[1].Trim()
       }
   } | Group-Object | Sort-Object Count -Descending

4. Review current user rights assignments:

   secedit /export /cfg C:\temp\current_rights.inf
   Get-Content C:\temp\current_rights.inf | Select-String "Se.*Privilege"

5. Implement immediate containment if suspicious activity is detected:
   • Disable affected user accounts temporarily
   • Reset passwords for compromised accounts
   • Review and revoke unnecessary privileges
   • Enable additional logging for affected systems
6. Document findings and create incident response timeline:

   $IncidentEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4699,4688,4624,4625; StartTime=(Get-Date).AddDays(-1)}
   $IncidentEvents | Export-Csv -Path "C:\temp\SecurityIncident_$(Get-Date -Format 'yyyyMMdd').csv"