Event ID 4704
A user right was assignedA user right was assigned.
Subject:
Security ID: %1
Account Name: %2
Account Domain: %3
Logon ID: %4
Target Account:
Account Name: %5
New Right:
User Right: %6Generates every time the local user right policy is changed and user right was assigned to an account.
Auditing: Always
Volume: Low
ISO 27001:2013 A.9.2.5
NIST 800-171: 3.1.1
NIST 800-171: 3.1.2
NIST 800-171: 3.3.8
NIST 800-171: 3.3.9
NIST SP 800-53: AC-2
NIST SP 800-53: AC-6 (7)
CMMC v2 L1: AC.L1-3.1.1
CMMC v2 L1: AC.L1-3.1.2
CMMC v2 L2: AU.L2-3.3.8
CMMC v2 L2: AU.L2-3.3.9
Microsoft Documentation
| Name | Field | Insertion String | OS | Example | ||
|---|---|---|---|---|---|---|
| Security ID | SubjectUserSid | %1 | Any | S-1-5-18 | ||
| Account Name | SubjectUserName | %2 | Any | DC05$ | ||
| Account Domain | SubjectDomainName | %3 | Any | MYDOMAIN | ||
| Logon ID | SubjectLogonId | %4 | Any | 0x3e7 | ||
| Account Name | TargetSid | %5 | Any | MYDOMAIN\JohnDoe | ||
| User Right | PrivilegeList | %6 | Any | View Codes | ||
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /subcategory:"Authorization Policy Change" LEFT/RIGHT arrow keys for navigation
Back to List