0

In the Event ID 4648, The subject's Account Name is the "Standard user". But under the credentials used section, the account name is of the "Administrator" and the Target Server is "LocalHost"and Account Domain is same as well. How is this possible? what is the exact interpretation of this Event?. Can the usage of any application cause this?

Screenshot of EVENT ID 4648 with mismatched credentials

Moshe Katz
  • 3,112
  • 5
  • 28
  • 43
Akhil Abraham
  • 1
  • 1

1 Answers1

1

I have many 4648 events on my main machine, for me this happens every time I am logged-in as a standard user and then run a new process as a different user, usually an administrator.

You can do this with runas.exe or Start-Process -verb runas, or in the GUI content menu Run as a different user or Run as administrator.

It may also happen when a scheduled tasks runs as a specific user, but I haven't checked that.

It may also happen when you connect to a network drive and have to provide different credentials.

Peter Hahndorf
  • 14,058
  • 3
  • 41
  • 58