At an agency, event 4624 records a successful logon for an ordinary user account, and event 4672 follows it showing special privileges assigned to that logon. What does event 4672 add?
Select an answer to reveal the explanation.
Short Explanation
Extra keys handed over at an ordinary sign-in are the news, not a story that the door failed. You already have a successful 4624, and 4672 adds that this logon received special privileges. The trap is calling 4672 a failed logon, a new scheduled task, or a cleared audit log.
Full Explanation
Event 4624 records a successful logon. Event 4672 records that special privileges were assigned to that new logon, meaning the token includes sensitive privileges of the kind associated with an administrator-class logon. For an account treated as an ordinary user, 4672 adds that privilege assignment on top of the success. Sensitive privileges, such as an administrator-class token, assigned to that successful ordinary-user logon is what 4672 contributes. A failed logon for the ordinary user, recorded here as the failure of that same attempt, would be a failed sign-in, and 4624 already shows success while 4672 is a privilege assignment, not a failure. Creation of a scheduled task on the agency workstation at the moment of this logon is a different event from special privileges on a logon. Clearing of the security audit log immediately after the ordinary user account signed on is the audit log being cleared, and 4672 does not clear the log. On the exam, 4672 shows sensitive privileges on that logon and does not by itself name which group grant caused them or prove a person's identity beyond the account. In operations, tie the 4672 record to the same logon as the 4624 and review why an ordinary account received those privileges.