Event ID: 4615

Invalid use of LPC port

Invalid use of LPC port.

Subject:
    Security ID:      %1
    Account Name:     %2
    Account Domain:   %3
    Logon ID:         %4

Process Information:
    PID:              %7
    Name:             %8

Invalid Use:          %5

LPC Server Port Name: %6

Windows Local Security Authority (LSA) communicates with the Windows kernel using Local Procedure Call (LPC) ports. If you see this event, an application has inadvertently or intentionally accessed this port which is reserved exclusively for LSA's use. The application (process) should be investigated to ensure that it is not attempting to tamper with this communications channel.
Microsoft Documentation

Event ID - 4615



According to Microsoft this event never gets logged.



Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"System Integrity"
How to enable Windows Auditing



LEFT/RIGHT arrow keys for navigation

Back to List