You can view your login history

enter image description here

I want to check if my roommate is checking my computer or not

I see that somebody login at 8:04:28 AM

I wasn't there.Also there is Special Logon. What is there?

Finally, what confuses me, that I rarely login at all.

Yet the event log says I logged in on 3:53 and 4:18 which is kind of a lot.

  • 1
    You have to read the actual log message.
    – Daniel B
    Sep 6, 2014 at 15:35

2 Answers 2


Source: 4672: Special privileges assigned to new logon

This event lets you know whenever an account assigned any "administrator equivalent" user rights logs on. For instance you will see event 4672 in close proximity to logon events (4624) for administrators since administrators have most of these admin-equivalent rights.

So, this is a useful right to detecting any "super user" account logons. Of course this right is logged for any server or applications accounts logging on as a batch job (scheduled task) or system service. See Logon Type: on event ID 4624. You can correlate 4672 to 4624 by Logon ID:.

Note: "User rights" and "privileges" are synonymous terms used interchangeably in Windows.

Admin-equivalent rights are powerful authorities that allow you to circumvent other security controls in Windows. Most admin equivalent privileges are intended for services and applications that interact closely with the operating system. With just a few exceptions, most admin equivalent privileges neither need nor should be granted to human user accounts.

Some Microsoft documentation puts this in the "Sensitive Privilege Use / Non-Sensitive Privilege Use" subcategory. However our testing finds this in the "Special Logon" Category.

To find out any more we need the content of the event.


Check the associated regular logon event (4624) with the same LogonID of the 4672 event.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .