Audit Non Sensitive Privilege Use

Applies to

  • Windows 10
  • Windows Server 2016

Audit Non Sensitive Privilege Use contains events that show usage of non-sensitive privileges. This is the list of non-sensitive privileges:

  • Access Credential Manager as a trusted caller

  • Add workstations to domain

  • Adjust memory quotas for a process

  • Bypass traverse checking

  • Change the system time

  • Change the time zone

  • Create a page file

  • Create global objects

  • Create permanent shared objects

  • Create symbolic links

  • Force shutdown from a remote system

  • Increase a process working set

  • Increase scheduling priority

  • Lock pages in memory

  • Modify an object label

  • Perform volume maintenance tasks

  • Profile single process

  • Profile system performance

  • Remove computer from docking station

  • Shut down the system

  • Synchronize directory service data

This subcategory also contains informational events from filesystem Transaction Manager.

If you configure this policy setting, an audit event is generated when a non-sensitive privilege is called. Success audits record successful attempts, and failure audits record unsuccessful attempts.

Event volume: Very High.

Computer Type General Success General Failure Stronger Success Stronger Failure Comments
Domain Controller No IF No IF We do not recommend Success auditing because the volume of events is very high and typically they are not as important as events from Audit Sensitive Privilege Use subcategory.
IF – You can enable Failure auditing if you need information about failed attempts to use non-sensitive privileges, for example, SeShutdownPrivilege or SeRemoteShutdownPrivilege.
Member Server No IF No IF We do not recommend Success auditing because the volume of events is very high and typically they are not as important as events from Audit Sensitive Privilege Use subcategory.
IF – You can enable Failure auditing if you need information about failed attempts to use non-sensitive privileges, for example, SeShutdownPrivilege or SeRemoteShutdownPrivilege.
Workstation No IF No IF We do not recommend Success auditing because the volume of events is very high and typically they are not as important as events from Audit Sensitive Privilege Use subcategory.
IF – You can enable Failure auditing if you need information about failed attempts to use non-sensitive privileges, for example, SeShutdownPrivilege or SeRemoteShutdownPrivilege.

Events List:

  • 4673(S, F): A privileged service was called.

  • 4674(S, F): An operation was attempted on a privileged object.

  • 4985(S): The state of a transaction has changed.