Windows event log ยท Security4703 A user right was adjusted
- Security
- 5 fields
Security.evtxMicrosoft-Windows-Security-Auditing
Fields EvtxECmd extracts
5 columns in the EvtxECmd CSV
- UserName
%domain%\%user% (%sid%)- %domain% = /Event/EventData/Data[@Name="SubjectDomainName"]
- %user% = /Event/EventData/Data[@Name="SubjectUserName"]
- %sid% = /Event/EventData/Data[@Name="SubjectUserSid"]
- ExecutableInfo
%ProcessName% (PID: %ProcessId%)- %ProcessName% = /Event/EventData/Data[@Name="ProcessName"]
- %ProcessId% = /Event/EventData/Data[@Name="ProcessId"]
- PayloadData1
Target: %domain%\%user% (%sid%)- %domain% = /Event/EventData/Data[@Name="TargetDomainName"]
- %user% = /Event/EventData/Data[@Name="TargetUserName"]
- %sid% = /Event/EventData/Data[@Name="TargetUserSid"]
- PayloadData2
EnabledPrivilegeList: %EnabledPrivilegeList%- %EnabledPrivilegeList% = /Event/EventData/Data[@Name="EnabledPrivilegeList"]
- PayloadData3
DisabledPrivilegeList: %DisabledPrivilegeList%- %DisabledPrivilegeList% = /Event/EventData/Data[@Name="DisabledPrivilegeList"]
Sample event
Event XML from the map file
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}"/>
<EventID>4703</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>13570</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2015-11-12T20:49:46.365958700Z"/>
<EventRecordID>5245</EventRecordID>
<Correlation/>
<Execution ProcessID="4" ThreadID="3632"/>
<Channel>Security</Channel>
<Computer>WIN-GG82ULGC9GO.contoso.local</Computer>
<Security/>
</System>
<EventData>
<Data Name="SubjectUserSid">S-1-5-18</Data>
<Data Name="SubjectUserName">WIN-GG82ULGC9GO$</Data>
<Data Name="SubjectDomainName">CONTOSO</Data>
<Data Name="SubjectLogonId">0x3e7</Data>
<Data Name="TargetUserSid">S-1-5-18</Data>
<Data Name="TargetUserName">WIN-GG82ULGC9GO$</Data>
<Data Name="TargetDomainName">CONTOSO</Data>
<Data Name="TargetLogonId">0x3e7</Data>
<Data Name="ProcessName">C:\\Windows\\System32\\svchost.exe</Data>
<Data Name="ProcessId">0x270</Data>
<Data Name="EnabledPrivilegeList">SeAssignPrimaryTokenPrivilege SeIncreaseQuotaPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeSystemtimePrivilege SeBackupPrivilege SeRestorePrivilege SeShutdownPrivilege SeSystemEnvironmentPrivilege SeUndockPrivilege SeManageVolumePrivilege</Data>
<Data Name="DisabledPrivilegeList">-</Data>
</EventData>
</Event>References
3 links
- ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4703(opens in new tab)
- docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4703(opens in new tab)
- github.com/nasbench/EVTX-ETW-Resources/blob/main/ETWProvidersCSVs/Internal/Microsoft-Windows-Security-Auditing.csv(opens in new tab)
Source: evtx/Maps/Security_Microsoft-Windows-Security-Auditing_4703.map(opens in new tab) by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)