SOC Event Lookup
Event ID 4621SystemP3

Windows Event ID 4621: Administrator recovered system from CrashOnAuditFail

Applicable version
Windows Server 2008 and later; Windows Vista and later
Last reviewed
2026-07-22

Quick summary

Windows Security Event ID 4621 records that an administrator recovered a system after CrashOnAuditFail halted it because auditable activity could not be recorded.

Technical Metadata

Technical metadata for Event ID 4621
Event ID4621
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
MITRE ATT&CKTA0112 Defense Impairment / T1685.001 Disable or Modify Tools: Disable or Modify Windows Event Log
Key fields to watchValue of CrashOnAuditFail, Computer, TimeCreated

Trigger Scenarios

The event is logged after reboot when CrashOnAuditFail equals 2 and users who are not administrators are allowed to log on again.

Key Fields

Value of CrashOnAuditFail

The reported value. Microsoft states the event generates when CrashOnAuditFail = 2, meaning the system had halted after failing to record an auditable event.

Computer

The recovered host. Prioritize domain controllers, jump servers, and systems where losing Security log coverage affects incident reconstruction.

TimeCreated

The reboot/recovery time. Use it to define the period where audit records may be incomplete.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Security Event ID 4621
SecurityEvent
| where EventID == 4621
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Map raw XML fields to the event-specific fields documented on this page.
Query reference
Splunk SPL: Retrieve Windows Security Event ID 4621
index=wineventlog source="WinEventLog:Security" EventCode=4621
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source and field aliases vary by deployment. Apply event-specific field conditions after validating local extraction.
Cortex XQL: Retrieve Windows Security Event ID 4621
dataset = microsoft_windows_raw
| filter edr_event_id = 4621
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The applicable Windows event channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Windows Security Event ID 4621
title: Windows Security Event ID 4621
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4621
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the documented conditions and correlations in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
CrashOnAuditFail2Microsoft documents value 2 as the state requiring administrator recovery after audit failure.Interpret CrashOnAuditFail with the complete event and correlated activity; this value alone is not proof of compromise. Source
EventID4621An administrator recovered the system from the CrashOnAuditFail condition.Interpret EventID with the complete event and correlated activity; this value alone is not proof of compromise. Source

MITRE ATT&CK Mapping

  • T1685.001Disable or Modify Tools: Disable or Modify Windows Event Log

Detection Notes

Microsoft recommends alerting on any 4621; use threshold=1 because CrashOnAuditFail = 2 means the host halted after it could not record an auditable event. In T1685.001 triage, that value proves Security Log coverage was disrupted before recovery, so review 4612 audit-discard events, disk/log health, and any 4719 or 1102 events before the reboot to distinguish resource failure from intentional logging impairment.

Common False Positives

  • Disk-full, log-service, or operating-system failures can trigger CrashOnAuditFail without malicious activity.
  • Recovery after planned maintenance may create this event if the host previously exhausted audit logging.

Related Events

Sample Log

Sanitized event sample
Administrator recovered system from CrashOnAuditFail.
Value of CrashOnAuditFail: 2
Computer: DC01

Frequently Asked Questions

What does Windows Event ID 4621 mean?

An administrator recovered a system that entered CrashOnAuditFail protection.

Does Event ID 4621 always indicate malicious activity?

No. Audit storage or resource failure can trigger recovery without malicious activity.

How should Event ID 4621 be investigated?

Review the CrashOnAuditFail value, audit queue and disk health, reboot evidence, and events preceding the loss of logging.

Sources