How to search logins for users with administrator rights from Windows event logs?

[chungangus]

We have captured Windows events, but have no idea how to identify the event to alert when a user with administrator rights logs on. Not sure the following event is appropriate and how to write the search...

576 - Specified privileges were added to a user's access token. (This event is generated when the user logs on.)

577 - A user attempted to perform a privileged system service operation.

578 - Privileges were used on an already open handle to a protected object.

4672 - Special privileges assigned to new logon

4673 - A privileged service was called

4674 - An operation was attempted on a privileged object

[joshd]

First, to clarify, the 5xx codes are from 2k3 whereas the 46xx codes are from 2k8. Ensure you're working with the right set of codes, or simply using both, when researching the event id's.

Next, I would personally go with 576 and 4672 since they signify specifically a logon event has occurred where the identity has privileged capabilities. The others are related to privileged operations that are not limited to login-time operations, but object accesses, etc...

Finally assuming you're using the Splunk for Windows TA you could use the following query to simply get a count of these events split by user ID:

sourcetype=WinEventLog:Security (EventCode=576 OR EventCode=4672) | stats count by user

[chungangus]

joshd,

Thanks for advice. I just come to Internet and find out those codes but no realize on the server version. I will have a try.