Event ID: 4621

Administrator recovered system from CrashOnAuditFail.

Administrator recovered system from CrashOnAuditFail. Users who are not administrators will now be allowed to log on. Some auditable activity might not have been recorded.

Value of CrashOnAuditFail:  %1

This event is logged after a system reboots following CrashOnAuditFail.
Microsoft Documentation

Event ID - 4621





Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"Security State Change"
How to enable Windows Auditing



LEFT/RIGHT arrow keys for navigation

Back to List