Event ID 4964: Special groups have been assigned to a new logon
Written when an account in a group you have marked as special (through the Special Groups registry setting) logs on.
- Log
- Security
- Category
- Logon
Why it matters
- Lets you raise an alert whenever, say, a Domain Admin logs on to an ordinary workstation.
What to check
Check which special group matched and whether that account should be logging on to this host.
How to turn it on
Advanced Audit Policy: Logon/Logoff > Audit Special Logon, plus the SpecialGroups value under HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit.
MITRE ATT&CK
- T1078 Valid Accounts