Event ID 4610

An authentication package has been loaded by the Local Security Authority

An authentication package has been loaded by the Local Security Authority.
This authentication package will be used to authenticate logon attempts.

Authentication Package Name:    %1

This event generates every time Authentication Package has been loaded by the Local Security Authority (LSA).

Each time the system starts, the LSA loads the Authentication Package DLLs from HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages registry value and performs the initialization sequence for every package located in these DLLs.

Microsoft Documentation

Event ID - 4610

Name		Field	Insertion String	OS	Example
	Authentication Package Name	AuthenticationPackageName	%1	Any	C:\\Windows\\system32\\msv1\_0.DLL : MICROSOFT\_AUTHENTICATION\_PACKAGE\_V1\_0

Lookup Audit Policy Configuration Settings


  C:\> AuditPol.exe /get  /subcategory:"Security System Extension"

How to enable Windows Auditing

Recommended Audit Policy

Operating Systems:

Windows Vista Windows 2008 Windows 7 Windows 2008 R2 Windows 8 Windows 2012 Windows 8.1 Windows 2012 R2 Windows 10 Windows 2016 Windows 2019 Windows 2022

Tags:

Audit Success

Audit Category:

System

Audit Subcategory:

Security System Extension

Legacy Events:

514

LEFT/RIGHT arrow keys for navigation

Back to List