Event ID 4703

A token right was adjusted

A token right was adjusted.

Subject:
    Security ID:        %1
    Account Name:       %2
    Account Domain:     %3
    Logon ID:           %4

Target Account:
    Security ID:        %5
    Account Name:       %6
    Account Domain:     %7
    Logon ID:           %8

Process Information:
    Process ID:         %10
    Process Name:       %9

Enabled Privileges:
            %11

Disabled Privileges:
            %12


To view the current privileges held by a user's token run whoami /priv.

NIST 800-171: 3.1.7
NIST SP 800-53: AC-6(1), AC-6(2),
CMMC v2 L2: AC-L2-3.1.7


Microsoft Documentation

Event ID - 4703



NameFieldInsertion StringOSExample
Security IDSubjectUserSid%1Any DOMAINA\UserA
Account NameSubjectUserName%2Any UserA
Account DomainSubjectDomainName%3Any DOMAINA
Logon IDSubjectLogonId%4Any 0x3e7
Security IDTargetUserSid%5Any DOMAINA\UserC
Account NameTargetUserName%6Any UserC
Account DomainTargetDomainName%7Any DOMAINA
Logon IDTargetLogonId%8Any 0x3e7
Process NameProcessName%9Any C:\Windows\System32\svchost.exe
Process IDProcessId%10Any 0x278
Enabled PrivilegesEnabledPrivilegeList%11Any View Codes
Disabled PrivilegesDisabledPrivilegeList%12Any View Codes


Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"Authorization Policy Change"



LEFT/RIGHT arrow keys for navigation

Back to List