Event Details
User Activity->Logons->Successful Logons->Windows 2000-2003->EventID 576 - Special privileges assigned to new logon (Privilege Use category)
EventID 576 - Special privileges assigned to new logon (Privilege Use category)
 Sample: 
        Event Type:     Success Audit
        Event Source:   Security
        Event Category: Privilege Use
        Event ID:       576
        Date:           10/26/2009
        Time:           07:31:44
        User:           NT AUTHORITY\SYSTEM
        Computer:       DC1
        Description:
        Special privileges assigned to new logon:
        User Name:	DC1$
        Domain:		RESEARCH
        Logon ID:		(0x0,0x60F7C2)
        Privileges:	SeSecurityPrivilege
        SeBackupPrivilege
        SeRestorePrivilege
        SeTakeOwnershipPrivilege
        SeDebugPrivilege
        SeSystemEnvironmentPrivilege
        SeLoadDriverPrivilege
        SeImpersonatePrivilege
        SeEnableDelegationPrivilege
Log Type: Windows Event Log
 Uniquely Identified By:
Log Name: Security
Filtering Field Equals to Value
OSVersion Windows 2000
Windows XP
Windows 2003
Category Privilege Use
Source Security
EventId 576
Field Matching
FieldDescriptionStored inSample Value
When At what date and time a user activity originated in the system. DateTime 1/1/2000
Who Account or user name under which the activity occured. User Name DC1$
What The type of activity occurred (e.g. Logon, Password Changed, etc.) "Special Privileges assigned" Special Privileges assigned
Where The name of the workstation/server where the activity was logged. Computer
Where From The name of the workstation/server where the activity was initiated from. - 10.10.10.10
Severity Specify the seriousness of the event. "Medium" Medium
WhoDomain Domain RESEARCH
WhereDomain -
Result Successful or Failed. "Successful" Successful
Failure Reason "Successful" Successful
Privileges Privileges Privileges SeSecurityPrivilege
Comments
You must be logged in to comment