EVENTID 4648. Mismatch ,Subject (Standard User), CredentialsUsed (Admin), Target(Localhost)

Question

In the Event ID 4648, The subject's Account Name is the "Standard user". But under the credentials used section, the account name is of the "Administrator" and the Target Server is "LocalHost"and Account Domain is same as well. How is this possible? what is the exact interpretation of this Event?. Can the usage of any application cause this?

Peter Hahndorf · Answer

I have many 4648 events on my main machine, for me this happens every time I am logged-in as a standard user and then run a new process as a different user, usually an administrator.
You can do this with runas.exe or Start-Process -verb runas, or in the GUI content menu Run as a different user or Run as administrator.
It may also happen when a scheduled tasks runs as a specific user, but I haven't checked that.
It may also happen when you connect to a network drive and have to provide different credentials.

EVENTID 4648. Mismatch ,Subject (Standard User), CredentialsUsed (Admin), Target(Localhost)

One Answer

Add your own answers!

Ask a Question