Direct answer
Event 4672 records special privileges assigned to a new logon. Correlate the account and logon session with the device's intended administrative or service activity.
Understand the event
Microsoft describes this event as special privileges assigned to a new logon. System services and administrators can generate legitimate events, so event presence alone is not evidence of misuse. The privilege list describes the token at logon, not necessarily actions later performed.
Reference: Microsoft: Security event 4672.
Correlate the session
Record the subject account, device, time, logon ID and privilege list. Compare with a related logon event on the same device and the approved role or service inventory. Protect account details when sharing reports and document missing fields or collection delays.
Review an example
A named support account receiving privileges during a scheduled support window may be expected. The same account on an unrelated laptop at an unusual time warrants verification with its owner and a review of associated process or access events. Consider legitimate automated maintenance as an alternative explanation.
Respond proportionately
Escalate unaccounted privileged sessions and preserve related records. Where excess membership is confirmed, coordinate privilege removal with the device and identity owners and retain a tested recovery path. Record the exact session and outcome rather than describing an assignment as proof of abuse.
Assessment limits
Assigned privileges do not establish that a privilege was exercised. Audit configuration, retention and forwarding determine visibility.
Frequently asked questions
Does event 4672 prove administrator abuse?
No. It records privileges assigned at logon and can occur during legitimate service or administrator activity.
Does the event show every later administrative action?
No. Correlate other relevant activity and evidence.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.