Event ID 4964

Special groups have been assigned to a new logon

Special groups have been assigned to a new logon.

Subject:
    Security ID:        %1
    Account Name:       %2
    Account Domain:     %3
    Logon ID:       %4
    Logon GUID: %5

New Logon:
    Security ID:        %6
    Account Name:       %7
    Account Domain:     %8
    Logon ID:       %9
    Logon GUID: %10
    Special Groups Assigned:    %11


Auditing:     Conditional

Enable auditing if you are utilizing the "Special Groups" windows feature.


Volume:

When "Special Groups" are enabled, volume depends on the configuration and types of users logging on.


Microsoft Documentation

Event ID - 4964



Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"Special Logon"



LEFT/RIGHT arrow keys for navigation

Back to List