0

I'm seeing periodic 4672 events (Special Logon) in my Windows Home 10 workstation.

What triggered my interest is that the events triggered by Security ID / Account name "SYSTEM", is that they occur at regular intervals over the last 12 hours.

Special privi0leges assigned to new logon.

Subject:
Security ID:        SYSTEM
Account Name:       SYSTEM
Account Domain:     NT AUTHORITY
Logon ID:       0x3E7

Privileges:
SeAssignPrimaryTokenPrivilege
            SeTcbPrivilege
        SeSecurityPrivilege
        SeTakeOwnershipPrivilege
        SeLoadDriverPrivilege
        SeBackupPrivilege
        SeRestorePrivilege
        SeDebugPrivilege
        SeAuditPrivilege
        SeSystemEnvironmentPrivilege
        SeImpersonatePrivilege

This occurs almost on the hour, overnight.

Then this morning I see an event 4797 (User account management) "An attempt was made to query the existence of a blank password for an account."

An attempt was made to query the existence of a blank password for an account.

Subject:
    Security ID:        -----
    Account Name:       -----
    Account Domain:     -----
    Logon ID:       0x946808E

Additional Information:
    Caller Workstation: -----
    Target Account Name:    Administrator
    Target Account Domain:  -----

This event is only seen once.

So my question is two-fold, what are the regular SYSTEM 4672 events and are they somehow related to the 4796 (User Account Management) event?

Thanks.

0 Answers0