Audit Special Logon
Some detection rules require monitoring special logon events to track privileged account usage. Special logon events indicate that an account with elevated privileges (such as administrators or service accounts) has logged in, helping detect unauthorized access or privilege escalation attempts.
To enable Audit Special Logon across a group of servers using Active Directory Group Policies, administrators must enable the Audit Special Logon policy. Follow these steps to configure the audit policy via Advanced Audit Policy Configuration:
Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policies Configuration > Audit Policies > Logon/Logoff > Audit Special Logon (Success) To enable this policy on a local machine, run the following command in an elevated command prompt:
auditpol.exe /set /subcategory:"Special Logon" /success:enable /failure:enable When this audit policy is enabled, the following event IDs may be generated:
- 4672: Special privileges assigned to new logon.
- 4964: Special groups have been assigned to a new logon.
Use the following GitHub search to identify rules that use the events listed: