Event ID 4696

A primary token was assigned to process

A primary token was assigned to process.

Subject:
    Security ID:        %1
    Account Name:       %2
    Account Domain:     %3
    Logon ID:           %4

Process Information:
    Process ID:         %11
    Process Name:       %12

Target Process:
    Target Process ID:   %9
    Target Process Name: %10

New Token Information:
    Security ID:        %5
    Account Name:       %6
    Account Domain:     %7
    Logon ID:           %8


This event generates every time a process runs using the non-current access token, for example, UAC elevated token, RUN AS different user actions, scheduled task with defined user, services, and so on.

IMPORTANT: This event is deprecated starting from Windows 7 and Windows 2008 R2.

Microsoft Documentation

Event ID - 4696



NameFieldInsertion StringOSExample
Security IDSubjectUserSid%1Any S-1-5-18
Account NameSubjectUserName%2Any WIN2008$
Account DomainSubjectDomainName%3Any DOMAIN
Logon IDSubjectLogonId%4Any 0x3e7
Security IDTargetUserSid%5Any S-1-5-18
Account NameTargetUserName%6Any dadmin
Account DomainTargetDomainName%7Any DOMAIN
Logon IDTargetLogonId%8Any 0x1c8c5
Target Process IDTargetProcessId%9Any 0xf40
Target Process NameTargetProcessName%10Any C:\\Windows\\System32\\WerFault.exe
Process IDProcessId%11Any 0x698
Process NameTargetProcessName%12Any C:\\Windows\\System32\\svchost.exe

Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"Process Creation"
How to enable Windows Auditing
Recommended Audit Policy

Operating Systems:
Windows VistaWindows 2008Windows 2008 R2Windows 7Windows 2012Windows 2012 R2Windows 8Windows 8.1Windows 10Windows 11Windows 2016Windows 2019Windows 2022Windows 2025

Tags:
Audit Success
Audit Category:
Detailed Tracking

Audit Subcategory:
Process Creation
Legacy Events:
600

LEFT/RIGHT arrow keys for navigation

Back to List