Event-o-Pedia EventID 4672 - Special privileges assigned to new logon.

	Event Details
	User Activity->Logons->Successful Logons->Windows 2008->EventID 4672 - Special privileges assigned to new logon.

EventID 4672 - Special privileges assigned to new logon.

Linked Event:

EventID 4672 - Special privileges assigned to new logon.

Sample:

        Special privileges assigned to new logon.

        Subject:
        Security ID:		%1
        Account Name:		%2
        Account Domain:		%3
        Logon ID:		%4

        Privileges:		%5

Log Type:

Windows Event Log

Uniquely Identified By:

Log Name:

Security

Filtering Field	Equals to Value
OSVersion	Windows Vista (2008) Windows 7 (2008 R2) Windows 8 (2012) Windows 8.1 (2012 R2) Windows 10 (2016)
Category	Logon/Logoff
Source	Microsoft-Windows-Security-Auditing
TaskCategory	Special Logon
EventId	4672

Field Matching

Field	Description	Stored in	Sample Value
When	At what date and time a user activity originated in the system.	DateTime	10.10.2000 19:00:00
Who	Account or user name under which the activity occured.	Subject: Account Name
What	The type of activity occurred (e.g. Logon, Password Changed, etc.)	"Special Privileges assigned"	Special Privileges assigned
Where	The name of the workstation/server where the activity was logged.	Computer	DC1
Where From	The name of the workstation/server where the activity was initiated from.	-	10.10.10.10
Severity	Specify the seriousness of the event.	"Medium"	Medium
WhoDomain		Subject: Account Domain
WhereDomain		-
Result	Successful or Failed.	"Successful"	Successful
Failure Reason		"Successful"	Successful
Privileges	Privileges	Privileges