Event ID: 4621

Administrator recovered system from CrashOnAuditFail.

Administrator recovered system from CrashOnAuditFail. Users who are not administrators will now be allowed to log on. Some auditable activity might not have been recorded.

Value of CrashOnAuditFail:  %1

This event is logged after a system reboots following CrashOnAuditFail.

NIST 800-171: 3.3.4
NIST SP 800-53: AU-5
CMMC v2 L2: AU.L2-3.3.4

Microsoft Documentation

Event ID - 4621

Lookup Audit Policy Configuration Settings


  C:\> AuditPol.exe /get  /subcategory:"Security State Change"

How to enable Windows Auditing

Recommended Audit Policy

Operating Systems:

Windows Vista Windows 2008 Windows 2008 R2 Windows 7 Windows 2012 Windows 2012 R2 Windows 8 Windows 8.1 Windows 10 Windows 2016 Windows 2019 Windows 2022

Tags:

Audit Success NIST SP 800-53 NIST 800-171 CMMC L2

Audit Category:

System

Audit Subcategory:

Security State Change

LEFT/RIGHT arrow keys for navigation

Back to List