Login of 1 account into WS 2022 results in enumerating all accounts' Groups? (ID 4798)

Question

Hey all,

• New AWS instance running Windows Server 2022 Datacenter (21H2)

Ran into a problem on a new server (AWS instance), running Windows Server 2022, where when I login (via Remote Desktop) as a user (Administrator, or otherwise), the login process is taking >3 minutes. It would seemingly get stuck at a blue screen, with just a power-button and the Accessibility button in the lower right corner.

At first, the session was just aborting... after about 45s it would close the RDP session. But a co-worker figured out if you just clicked the power button to bring up the menu, it would maintain the connection until the process was complete.

Once in, was able to see in the Event Viewer a whole bunch of 4798 'User Account Management' events, which is '...local group membership was enumerated'. There are 1500+ local OS user accounts on this machine. This machine is not part of a Domain, not part of Azure, not linked to an AD system - nothing like that. These are new accounts that I just created, via a Powershell script. Each of these users is only a member of 1 Group - one of 4 new local Groups that I created for these special authentication users.

So... why is it doing this? Every time somebody logs in it is going through this process. We have an older WS 2016 machine that we are migrating here - the old machine doesn't do this.

I'm OK with it perhaps having to do it once - these are brand new accounts, sure, there might be some administration to be done with them. But not every-single-time-anybody logs in??!! :(

We have these user accounts because there is a DB Management solution that can (and does) use the local OS accounts to authenticate against. So these users aren't actually ever logging into this machine. But as the Admin I need to log into it periodically, and I will be using RDP. (But my co-workers and I are the only ones.)

Answer 1

Hello J_at_Adatasol,

Thank you for posting in Q&A forum.

Security Monitoring Recommendations

For 4798(S): A user's local group membership was enumerated.

Important  

For this event, also see Appendix A: Security monitoring recommendations for many audit events.

• If you have high value domain or local accounts for which you need to monitor each enumeration of their group membership, or any access attempt, monitor events with the “Subject\Security ID” that corresponds to the high value account or accounts.
• If you have a pre-defined “Process Name” for the process reported in this event, monitor all events with “Process Name” not equal to your defined value.
• You can monitor to see if “Process Name” is not in a standard folder (for example, not in System32 or Program Files) or is in a restricted folder (for example, Temporary Internet Files).
• If you have a pre-defined list of restricted substrings or words in process names (for example, “mimikatz” or “cain.exe”), check for these substrings in “Process Name.”

Ref: https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4798

 

I hope the information above is helpful.

If you have any questions or concerns, please feel free to let us know.

Best Regards,

Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.

Answer 2

Bumping this thread... why does Windows enumerate the group for all users, whenever only 1 user logs in? It makes the login process take about 2 minutes.

Answer 3

Bumpity bump.

Answer 4

Bump to the top.