Security Auditing ID: 4624/4672 Special Logon and Logon

Question

Hello, Im constantly getting this audit success every 5-10 minutes. I need help on what this is, and how can I fix it, because it freezes my computer like hardlock and goes back to normal. Here is both events Views. First is Special Logon and Second is Logon

SPECIAL LOGON

<Event xmlns="**http://schemas.microsoft.com/win/2004/08/events/event**">

• <System> <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" /><EventID>4672</EventID><Version>0</Version><Level>0</Level><Task>12548</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime="2022-11-09T21:41:50.8612935Z" /><EventRecordID>52699</EventRecordID><Correlation ActivityID="{24183577-f47f-000c-9d46-18247ff4d801}" /><Execution ProcessID="1288" ThreadID="14124" /><Channel>Security</Channel><Computer>BrandonsCom</Computer><Security /></System>
• <EventData> <Data Name="SubjectUserSid">S-1-5-18</Data><Data Name="SubjectUserName">SYSTEM</Data><Data Name="SubjectDomainName">NT AUTHORITY</Data><Data Name="SubjectLogonId">0x3e7</Data><Data Name="PrivilegeList">SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege</Data></EventData> </Event>

LOGON

<Event xmlns="**http://schemas.microsoft.com/win/2004/08/events/event**">

• <System> <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" /><EventID>4624</EventID><Version>3</Version><Level>0</Level><Task>12544</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime="2022-11-09T21:41:50.8612886Z" /><EventRecordID>52698</EventRecordID><Correlation ActivityID="{24183577-f47f-000c-9d46-18247ff4d801}" /><Execution ProcessID="1288" ThreadID="14124" /><Channel>Security</Channel><Computer>BrandonsCom</Computer><Security /></System>
• <EventData> <Data Name="SubjectUserSid">S-1-5-18</Data><Data Name="SubjectUserName">BRANDONSCOM$</Data><Data Name="SubjectDomainName">WORKGROUP</Data><Data Name="SubjectLogonId">0x3e7</Data><Data Name="TargetUserSid">S-1-5-18</Data><Data Name="TargetUserName">SYSTEM</Data><Data Name="TargetDomainName">NT AUTHORITY</Data><Data Name="TargetLogonId">0x3e7</Data><Data Name="LogonType">5</Data><Data Name="LogonProcessName">Advapi</Data><Data Name="AuthenticationPackageName">Negotiate</Data><Data Name="WorkstationName">-</Data><Data Name="LogonGuid">{00000000-0000-0000-0000-000000000000}</Data><Data Name="TransmittedServices">-</Data><Data Name="LmPackageName">-</Data><Data Name="KeyLength">0</Data><Data Name="ProcessId">0x4f0</Data><Data Name="ProcessName">C:\Windows\System32\services.exe</Data><Data Name="IpAddress">-</Data><Data Name="IpPort">-</Data><Data Name="ImpersonationLevel">%%1833</Data><Data Name="RestrictedAdminMode">-</Data><Data Name="RemoteCredentialGuard">-</Data><Data Name="TargetOutboundUserName">-</Data><Data Name="TargetOutboundDomainName">-</Data><Data Name="VirtualAccount">%%1843</Data><Data Name="TargetLinkedLogonId">0x0</Data><Data Name="ElevatedToken">%%1842</Data></EventData> </Event>

Answer 1

Hi xXxPR3DAT0RxXxX,

Thank you for using our Microsoft community.

This question is out of scope for the Answers Support Community. The best place to get help is Microsoft Ignite - Windows-Server(microsoft.com) **** & **** Microsoft Ignite - Windows-11(microsoft.com), where is intended to support more advanced users.

The following links may help you.

4672(S) Special privileges assigned to new logon. (Windows 10) - Windows security | Microsoft Learn

4624(S) An account was successfully logged on. (Windows 10) - Windows security | Microsoft Learn

If anything is unclear, please do not hesitate to let me know.

Best Regards,

Mosken_L - MSFT | Microsoft Community Support Specialist