THis is the last event 4672 - Special Log On - there is no 4657 The one before is 4624 - Log On
Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 03/10/2024 13:48:03 Event ID: 4672 Task Category: Special Logon Level: Information Keywords: Audit Success User: N/A Computer: Main-Desktop-PC Description: Special privileges assigned to new logon. Subject: Security ID: SYSTEM Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3E7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege Event Xml: http://schemas.microsoft.com/win/2004/08/events/event"> 4672 0 0 12548 0 0x8020000000000000 9605014 Security Main-Desktop-PC S-1-5-18 SYSTEM NT AUTHORITY 0x3e7 SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege