Event ID: 4621Administrator recovered system from CrashOnAuditFail.
Administrator recovered system from CrashOnAuditFail. Users who are not administrators will now be allowed to log on. Some auditable activity might not have been recorded. Value of CrashOnAuditFail: %1 This event is logged after a system reboots following CrashOnAuditFail.
NIST 800-171: 3.3.4
NIST SP 800-53: AU-5
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /subcategory:"Security State Change"
LEFT/RIGHT arrow keys for navigationBack to List