Event ID 4608

Windows is starting up

Windows is starting up.

This event is logged when LSASS.EXE starts and the auditing subsystem is initialized.

This event is logged when LSASS.EXE process starts and the auditing subsystem is initialized.

It typically generates during operating system startup process.

PCI 3.2.1: 10.2.6

Microsoft Documentation

Event ID - 4608


  C:\> AuditPol.exe /get  /subcategory:"Security State Change"

Audit Success PCI-DSS

System

512

LEFT/RIGHT arrow keys for navigation