{"id":3337,"date":"2013-06-24T11:59:00","date_gmt":"2013-06-24T11:59:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2013\/06\/24\/powertip-audit-special-privilege-use-with-powershell\/"},"modified":"2013-06-24T11:59:00","modified_gmt":"2013-06-24T11:59:00","slug":"powertip-audit-special-privilege-use-with-powershell","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/powertip-audit-special-privilege-use-with-powershell\/","title":{"rendered":"PowerTip: Audit Special Privilege Use with PowerShell"},"content":{"rendered":"

Summary<\/strong>: Learn how to audit special privilege use with Windows PowerShell.<\/span><\/p>\n

\"Hey, How can I easily find information about auditing special privileges that are assigned to various logon IDs if I am running Windows 8 and Windows Server 2012?<\/p>\n

\"Hey, Start Windows PowerShell with Admin rights. Use the Get-EventLog<\/strong> cmdlet to query the security event log, look for InstanceID 4672, and select TimeWritten<\/strong> and Message<\/strong>. To make it easier to read, use Format-Table, and autosize and wrap the entries:<\/p>\n

PS C:> Get-EventLog security -InstanceId 4672 -newest 20| ft timewritten, message -auto -wr<\/p>\n

TimeWritten           Message<\/p>\n

———–           ——-<\/p>\n

6\/19\/2013 12:03:01 PM Special privileges assigned to new logon.<\/p>\n

 <\/p>\n

                      Subject:<\/p>\n

                          Security ID:        S-1-5-18<\/p>\n

                          Account Name:        SYSTEM<\/p>\n

                          Account Domain:        NT AUTHORITY<\/p>\n

                          Logon ID:        0x3e7<\/p>\n

 <\/p>\n

                      Privileges:        SeAssignPrimaryTokenPrivilege<\/p>\n

                                  SeTcbPrivilege<\/p>\n

                                  SeSecurityPrivilege<\/p>\n

                                  SeTakeOwnershipPrivilege<\/p>\n

                                  SeLoadDriverPrivilege<\/p>\n

                                  SeBackupPrivilege<\/p>\n

                                  SeRestorePrivilege<\/p>\n

                                  SeDebugPrivilege<\/p>\n

                                  SeAuditPrivilege<\/p>\n

                                  SeSystemEnvironmentPrivilege<\/p>\n

                                  SeImpersonatePrivilege<\/p>\n","protected":false},"excerpt":{"rendered":"

Summary: Learn how to audit special privilege use with Windows PowerShell.  How can I easily find information about auditing special privileges that are assigned to various logon IDs if I am running Windows 8 and Windows Server 2012?  Start Windows PowerShell with Admin rights. Use the Get-EventLog cmdlet to query the security event log, look […]<\/p>\n","protected":false},"author":596,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[356,3,45],"class_list":["post-3337","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-powertip","tag-scripting-guy","tag-windows-powershell"],"acf":[],"blog_post_summary":"

Summary: Learn how to audit special privilege use with Windows PowerShell.  How can I easily find information about auditing special privileges that are assigned to various logon IDs if I am running Windows 8 and Windows Server 2012?  Start Windows PowerShell with Admin rights. Use the Get-EventLog cmdlet to query the security event log, look […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/3337","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/596"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=3337"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/3337\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=3337"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=3337"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=3337"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}