new build

windows/keep-secure/audit-non-sensitive-privilege-use.md

@@ -0,0 +1,129 @@
+---
+title: Audit Non-Sensitive Privilege Use (Windows 10)
+description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Non-Sensitive Privilege Use, which determines whether the operating system generates audit events when non-sensitive privileges (user rights) are used.
+ms.assetid: 8fd74783-1059-443e-aa86-566d78606627
+ms.prod: W10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+author: brianlic-msft
+---
+
+# Audit Non-Sensitive Privilege Use
+
+
+**Applies to**
+
+-   Windows 10
+
+This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Non-Sensitive Privilege Use**, which determines whether the operating system generates audit events when non-sensitive privileges (user rights) are used.
+
+The following privileges are non-sensitive:
+
+-   **Access Credential Manager as a trusted caller**
+
+-   **Access this computer from the network**
+
+-   **Add workstations to domain**
+
+-   **Adjust memory quotas for a process**
+
+-   **Allow log on locally**
+
+-   **Allow log on through Terminal Services**
+
+-   **Bypass traverse checking**
+
+-   **Change the system time**
+
+-   **Create a page file**
+
+-   **Create global objects**
+
+-   **Create permanent shared objects**
+
+-   **Create symbolic links**
+
+-   **Deny access to this computer from the network**
+
+-   **Deny log on as a batch job**
+
+-   **Deny log on as a service**
+
+-   **Deny log on locally**
+
+-   **Deny log on through Terminal Services**
+
+-   **Force shutdown from a remote system**
+
+-   **Increase a process working set**
+
+-   **Increase scheduling priority**
+
+-   **Lock pages in memory**
+
+-   **Log on as a batch job**
+
+-   **Log on as a service**
+
+-   **Modify an object label**
+
+-   **Perform volume maintenance tasks**
+
+-   **Profile single process**
+
+-   **Profile system performance**
+
+-   **Remove computer from docking station**
+
+-   **Shut down the system**
+
+-   **Synchronize directory service data**
+
+If you configure this policy setting, an audit event is generated when a non-sensitive privilege is called. Success audits record successful attempts, and failure audits record unsuccessful attempts.
+
+Event volume: Very high
+
+Default: Not configured
+
+<table>
+<colgroup>
+<col width="50%" />
+<col width="50%" />
+</colgroup>
+<thead>
+<tr class="header">
+<th align="left">Event ID</th>
+<th align="left">Event message</th>
+</tr>
+</thead>
+<tbody>
+<tr class="odd">
+<td align="left"><p>4672</p></td>
+<td align="left"><p>Special privileges assigned to new logon.</p></td>
+</tr>
+<tr class="even">
+<td align="left"><p>4673</p></td>
+<td align="left"><p>A privileged service was called.</p></td>
+</tr>
+<tr class="odd">
+<td align="left"><p>4674</p></td>
+<td align="left"><p>An operation was attempted on a privileged object.</p></td>
+</tr>
+</tbody>
+</table>
+
+ 
+
+## Related topics
+
+
+[Advanced security audit policy settings](advanced-security-audit-policy-settings.md)
+
+ 
+
+ 
+
+
+
+
+