Windows Event ID 4976 – Microsoft-Windows-Security-Auditing: Special Logon

Start by examining the specific details of Event ID 4976 to understand which account received privileges and what permissions were granted.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4976 by right-clicking the Security log and selecting Filter Current Log
4. Enter 4976 in the Event IDs field and click OK
5. Double-click on a 4976 event to view detailed information including:
   • Subject account (who initiated the logon)
   • Target account (who received the privileges)
   • Logon type and authentication package
   • Complete list of privileges granted
6. Note the Privileges field which lists specific rights like SeServiceLogonRight, SeBatchLogonRight, or SeNetworkLogonRight

Use PowerShell to programmatically analyze Event ID 4976 occurrences and extract detailed privilege information for security analysis.

1. Open PowerShell as Administrator
2. Query recent Event ID 4976 entries:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4976} -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message

3. Extract specific account and privilege details:

   $events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4976} -MaxEvents 100
   foreach ($event in $events) {
       $xml = [xml]$event.ToXml()
       $targetAccount = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'} | Select-Object -ExpandProperty '#text'
       $privileges = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'PrivilegeList'} | Select-Object -ExpandProperty '#text'
       Write-Output "Time: $($event.TimeCreated) | Account: $targetAccount | Privileges: $privileges"
   }

4. Filter for specific accounts or time ranges:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4976; StartTime=(Get-Date).AddHours(-24)} | Where-Object {$_.Message -like '*ServiceAccount*'}

5. Export results for analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4976} -MaxEvents 500 | Export-Csv -Path "C:\Temp\Event4976_Analysis.csv" -NoTypeInformation

Investigate the source of special privileges by examining local security policies and Group Policy settings that grant user rights.

1. Open Local Security Policy by running secpol.msc from the Run dialog
2. Navigate to Security Settings → Local Policies → User Rights Assignment
3. Review key policies that trigger Event ID 4976:
   • Log on as a service (SeServiceLogonRight)
   • Log on as a batch job (SeBatchLogonRight)
   • Allow log on through Remote Desktop Services
   • Act as part of the operating system
4. Check Group Policy settings using PowerShell:

   secedit /export /cfg C:\Temp\current_policy.inf
   Get-Content C:\Temp\current_policy.inf | Select-String "SeServiceLogonRight|SeBatchLogonRight|SeNetworkLogonRight"

5. For domain environments, examine Group Policy Objects:

   Get-GPOReport -All -ReportType Html -Path "C:\Temp\GPO_Report.html"

6. Cross-reference the accounts in Event ID 4976 with the user rights assignments to verify legitimate privilege grants

Focus on service accounts that frequently generate Event ID 4976 to ensure they're operating within expected parameters and haven't been compromised.

1. Identify service accounts generating Event ID 4976:

   $serviceEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4976} -MaxEvents 1000
   $serviceAccounts = @{}
   foreach ($event in $serviceEvents) {
       $xml = [xml]$event.ToXml()
       $account = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'} | Select-Object -ExpandProperty '#text'
       if ($serviceAccounts.ContainsKey($account)) {
           $serviceAccounts[$account]++
       } else {
           $serviceAccounts[$account] = 1
       }
   }
   $serviceAccounts.GetEnumerator() | Sort-Object Value -Descending

2. Check service configurations for these accounts:

   Get-WmiObject Win32_Service | Where-Object {$_.StartName -like '*service*'} | Select-Object Name, StartName, State, StartMode

3. Verify service account logon rights in the registry:

   $regPath = "HKLM\SYSTEM\CurrentControlSet\Services"
   Get-ChildItem $regPath | ForEach-Object {
       $serviceName = $_.PSChildName
       $objectName = Get-ItemProperty -Path "$regPath\$serviceName" -Name "ObjectName" -ErrorAction SilentlyContinue
       if ($objectName) {
           Write-Output "$serviceName : $($objectName.ObjectName)"
       }
   }

4. Monitor for unusual privilege patterns:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4976; StartTime=(Get-Date).AddDays(-7)} | 
   Group-Object {($_.Message -split '\n' | Select-String 'Account Name:').ToString().Split(':')[1].Trim()} | 
   Sort-Object Count -Descending | Select-Object Name, Count

5. Set up continuous monitoring with a scheduled task to alert on suspicious service account privilege usage

Perform comprehensive security analysis by correlating Event ID 4976 with other security events to detect potential privilege escalation or unauthorized access.

1. Create a comprehensive security event correlation script:

   $startTime = (Get-Date).AddDays(-1)
   $events4976 = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4976; StartTime=$startTime}
   $events4624 = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=$startTime}
   $events4648 = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4648; StartTime=$startTime}
   
   # Correlate privilege grants with logon events
   foreach ($privEvent in $events4976) {
       $xml = [xml]$privEvent.ToXml()
       $targetUser = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'} | Select-Object -ExpandProperty '#text'
       $logonId = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetLogonId'} | Select-Object -ExpandProperty '#text'
       
       $relatedLogon = $events4624 | Where-Object {
           $logonXml = [xml]$_.ToXml()
           $logonIdField = $logonXml.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetLogonId'} | Select-Object -ExpandProperty '#text'
           $logonIdField -eq $logonId
       }
       
       if ($relatedLogon) {
           Write-Output "Privilege Grant: $($privEvent.TimeCreated) | User: $targetUser | Logon ID: $logonId"
       }
   }

2. Analyze privilege escalation patterns:

   $suspiciousPatterns = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4976} | Where-Object {
       $_.Message -match 'SeDebugPrivilege|SeTcbPrivilege|SeCreateTokenPrivilege'
   }
   $suspiciousPatterns | Select-Object TimeCreated, Message

3. Check for privilege abuse indicators by examining registry keys:

   $auditPath = "HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit"
   if (Test-Path $auditPath) {
       Get-ItemProperty -Path $auditPath | Format-List
   }

4. Generate security reports combining multiple event sources:

   $report = @()
   $events4976 | ForEach-Object {
       $xml = [xml]$_.ToXml()
       $report += [PSCustomObject]@{
           TimeCreated = $_.TimeCreated
           EventId = $_.Id
           TargetUser = ($xml.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'}).'#text'
           Privileges = ($xml.Event.EventData.Data | Where-Object {$_.Name -eq 'PrivilegeList'}).'#text'
           LogonType = ($xml.Event.EventData.Data | Where-Object {$_.Name -eq 'LogonType'}).'#text'
       }
   }
   $report | Export-Csv -Path "C:\Temp\PrivilegeAudit_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation

5. Configure Windows Event Forwarding (WEF) for centralized monitoring of Event ID 4976 across multiple systems