how i can see UAC level changes in event log?


Why is it that when modifying the User Account Control (UAC) level, no events are observed that contain the new UAC level, and does Microsoft log the UAC level change in the event log?

User's image

Windows 10 Security
Windows 10 Security
Windows 10: A Microsoft operating system that runs on personal computers and tablets.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
2,804 questions
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Limitless Technology 44,036 Reputation points


    Thank you for your question and for reaching out with your question today.

    In order to achieve what you're looking for, you can enable UAC auditing (local GPO):

    Computer Configuration – Windows Settings – Security Settings – Local Policies – Audit Policy

    Enable the policies listed below:

    Audit privilege use

    Audit process tracking

    As a result of this change, you can observe Event ID 4688 and 4689 at the below event location when you change UAC:

    Event Viewer – Windows Logs – Security.

    If the reply was helpful, please don’t forget to upvote or accept as answer.

    0 comments No comments