Event Details
Operating System->Microsoft Windows->Built-in logs->Windows 2000-2003->Security Log->Policy Change->EventID 621 - System Security Access Granted [Win 2003 / XP]
EventID 621 - System Security Access Granted [Win 2003 / XP]

This event record indicates that a user account was granted logon rights (such as "Access this computer from the network" or "Logon as a service").

Find more information about this event on ultimatewindowssecurity.com.

Corresponding events on other OS versions:

Windows 2008
Related events:
This event and EventID 622 log assignments of logon rights only, such as "Access this computer from the network" or "Logon as a service" - not other rights such as "Change the system time" or "Take ownership of files and other objects". For other rights assignments/removals see the following events:
    Event Type:     Success Audit
    Event Source:   Security
    Event Category: Policy Change
    Event ID:       621
    Date:           10/26/2009
    Time:           07:41:24
    User:           RESEARCH\ALebovsky
    Computer:       DC1
    System Security Access Granted:
    	Access Granted:	SeServiceLogonRight
    	Account Modified:	%{S-1-5-21-184992632-1607737289-1287950321-1185}
    	Assigned By:
    	  User Name:	Alebovsky
    	  Domain:		RESEARCH
    	  Logon ID:	(0x0,0x59DF36)
    Log Type: Windows Event Log
     Uniquely Identified By:
    Log Name: Security
    Filtering Field Equals to Value
    OSVersion Windows 2003
    Windows XP
    Category Policy Change
    Source Security
    EventId 621
    Field Matching
    FieldDescriptionStored inSample Value
    DateTime Date/Time of event origination in GMT format. DateTime 10.10.2000 19:00:00
    Source Name of an Application or System Service originating the event. Source Security
    Type Warning, Information, Error, Success, Failure, etc. Type Success
    User Domain\Account name of user/service/computer initiating event. User RESEARCH\Alebovsky
    Computer Name of server workstation where event was logged. Computer DC1
    EventID Numerical ID of event. Unique within one Event Source. EventId 576
    Description The entire unparsed event message. Description Special privileges assigned to new logon.
    Log Name The name of the event log (e.g. Application, Security, System, etc.) LogName Security
    Category A name for a subclass of events within the same Event Source. Category Logon/Logoff
    Access Granted System name of the logon right assigned. Please see logon right descriptions here. InsertionString4
    Account Modified The user or group who was assigned the right , prefixed by domain name InsertionString5 %{S-1-5-21-184992632-1607737289-1287950321-1185}
    User Name The user who assigned the right. Normally the computer name where the right was assigned. InsertionString1 Alebovsky
    Domain Domain of the "Assigned by" InsertionString2 RESEARCH
    Logon ID ID of the logon session of the user who assigned the right. Useful for tracking other user activity during the same logon session. InsertionString3 (0x0,0x59DF36)
    You must be logged in to comment