Privilege constants can appear in several distinct Security event fields. Event ID 4672 lists selected sensitive privileges attached to a new logon, while 4673 and 4674 list privileges requested during attempted operations. Event ID 4703 separately reports privileges enabled or disabled in an existing token, and 4704/4705 report local user-right policy assignment and removal. None of these events alone proves a complete assignment-to-use sequence. The %%NNNN tokens in raw XML resolve to the descriptions below.
Privilege Constants#
| Constant | Description | msobjs Code |
|---|---|---|
| SeAssignPrimaryTokenPrivilege | Replace a process-level token | %%1603 |
| SeLockMemoryPrivilege | Lock pages in memory | %%1604 |
| SeIncreaseQuotaPrivilege | Adjust memory quotas for a process | %%1605 |
| SeTcbPrivilege | Act as part of the operating system | %%1607 |
| SeSecurityPrivilege | Manage auditing and security log | %%1608 |
| SeTakeOwnershipPrivilege | Take ownership of files or other objects | %%1609 |
| SeLoadDriverPrivilege | Load and unload device drivers | %%1610 |
| SeSystemProfilePrivilege | Profile system performance | %%1611 |
| SeSystemtimePrivilege | Change the system time | %%1612 |
| SeProfileSingleProcessPrivilege | Profile single process | %%1613 |
| SeIncreaseBasePriorityPrivilege | Increase scheduling priority | %%1614 |
| SeCreatePagefilePrivilege | Create a pagefile | %%1615 |
| SeCreatePermanentPrivilege | Create permanent shared objects | %%1616 |
| SeBackupPrivilege | Back up files and directories | %%1617 |
| SeRestorePrivilege | Restore files and directories | %%1618 |
| SeShutdownPrivilege | Shut down the system | %%1619 |
| SeDebugPrivilege | Debug programs | %%1620 |
| SeAuditPrivilege | Generate security audits | %%1621 |
| SeSystemEnvironmentPrivilege | Modify firmware environment values | %%1622 |
| SeChangeNotifyPrivilege | Bypass traverse checking | %%1623 |
| SeRemoteShutdownPrivilege | Force shutdown from a remote system | %%1624 |
| SeCreateTokenPrivilege | Create a token object | — |
| SeImpersonatePrivilege | Impersonate a client after authentication | — |
| SeCreateGlobalPrivilege | Create global objects | — |
| SeMachineAccountPrivilege | Add workstations to domain | — |
| SeManageVolumePrivilege | Perform volume maintenance tasks | — |
| SeRelabelPrivilege | Modify an object label | — |
| SeIncreaseWorkingSetPrivilege | Increase a process working set | — |
| SeTimeZonePrivilege | Change the time zone | — |
| SeUndockPrivilege | Remove computer from docking station | — |
| SeEnableDelegationPrivilege | Enable computer and user accounts to be trusted for delegation | — |
| SeTrustedCredManAccessPrivilege | Access Credential Manager as a trusted caller | — |
| SeSyncAgentPrivilege | Synchronize directory service data | — |
| SeCreateSymbolicLinkPrivilege | Create symbolic links | — |
| SeDelegateSessionUserImpersonatePrivilege | Obtain an impersonation token for another user in the same session | — |
Investigation Starting Points#
Review privilege assignment, token enablement, attempted use, and audit prerequisites separately. Build expectations for accounts, services, and processes from the environment being investigated. A privilege on 4672 is not by itself anomalous or proof that it was used.
| Constant | Capability to review | Relevant evidence |
|---|---|---|
| SeDebugPrivilege | Cross-account process debugging and memory access | Review assignment, logon, adjustment, and documented service-attempt evidence separately |
| SeTcbPrivilege | Trusted-computing-base and token operations | Preserve service, process, session, and audit-identity limitations |
| SeLoadDriverPrivilege | Dynamic kernel driver loading and unloading | Privilege evidence does not establish that platform driver checks accepted a load |
| SeBackupPrivilege | Backup-oriented read access despite file DACLs | Use auditing needs the additional Backup and Restore audit setting |
| SeRestorePrivilege | Restore-oriented modification, ownership, and protection changes | Use auditing needs the additional Backup and Restore audit setting |
| SeImpersonatePrivilege | Acting in an authenticated client's token context | Establish the client and impersonation level outside the shared privilege events |
| SeTakeOwnershipPrivilege | Ownership changes without ordinary WRITE_OWNER access | 4674 describes an attempted operation and must retain outcome and object context |
| SeAssignPrimaryTokenPrivilege | Assigning a process primary token | API prerequisites and process evidence are needed beyond token adjustment |
Related Events#
- Microsoft-Windows-Security-Auditing Event ID 4672: Special privileges assigned to new logon
- Microsoft-Windows-Security-Auditing Event ID 4673: A privileged service was called
- Microsoft-Windows-Security-Auditing Event ID 4674: An operation was attempted on a privileged object
- Microsoft-Windows-Security-Auditing Event ID 4703: A user right was adjusted
- Microsoft-Windows-Security-Auditing Event ID 4704: A user right was assigned
- Microsoft-Windows-Security-Auditing Event ID 4705: A user right was removed
- Microsoft-Windows-Security-Auditing Event ID 4688: A new process has been created, TokenElevationType field
Source: Windows SDK, msobjs.dll message table (Windows 11 25H2, build 26100)