Event ID: 4621

Administrator recovered system from CrashOnAuditFail.

Administrator recovered system from CrashOnAuditFail. Users who are not administrators will now be allowed to log on. Some auditable activity might not have been recorded.

Value of CrashOnAuditFail:  %1

This event is logged after a system reboots following CrashOnAuditFail.


NIST 800-171: 3.3.4
NIST SP 800-53: AU-5
CMMC L3


Microsoft Documentation

Event ID - 4621



Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"Security State Change"



LEFT/RIGHT arrow keys for navigation

Back to List