Administrator Recovered System From CrashOnAuditFail Users Who Are Not Administrators Will Now Be Allowed To Log On Some Auditable Activity Might Not Have Been Recorded
Administrator recovered system from CrashOnAuditFail. Users who are not administrators will now be allowed to log on. Some auditable activity might not have been recorded.
Configuration
query
EventID:4621
config
Key | Value — | — type | aggregation-v1 query | EventID:4621 streams | [5f74fe0891d2ba1b645adb8d] conditions | {expression:null} search_within_ms | 3600000 execute_every_ms | 3600000
SIEM Microsoft Events to Monitor
https://docs.
notes
Last modified
December 31, 1969