Special privileges assigned to new logon

What it means

An account with administrator-level privileges signed in.

Why it matters

Tells you when privileged accounts are used. Admin logons on ordinary workstations raise the risk of credential theft.

What to do

• Keep a list of expected admin accounts and alert on others.
• Review admin logons on non-server machines.

Find it with PowerShell

Get-WinEvent -MaxEvents 20 -FilterHashtable @{
  LogName = 'Security'; Id = 4672
} | Select-Object TimeCreated, ProviderName, Message

Add -ComputerName SERVER to query another machine. Other event sources can reuse the same ID number, so check the ProviderName column.