Windows Event ID 4964: Special groups have been assigned to a new logon
- Applicable version
- Windows Server 2008 R2 and later
- Last reviewed
- 2026-07-21
Quick summary
Windows Security Event ID 4964 records a logon by an account that is a member of a configured Special Group.
Technical Metadata
| Event ID | 4964 |
|---|---|
| Provider | Microsoft-Windows-Security-Auditing |
| Channel | Security |
| Level | Information |
| Audit keyword | Audit Success |
| MITRE ATT&CK | TA0001 Initial Access / T1078.002 Valid Accounts: Domain Accounts |
| Key fields to watch | SidList, TargetUserName / TargetLogonId / TargetLogonGuid, SubjectLogonId |
Trigger Scenarios
This event occurs when a member of a group SID listed in HKLM\System\CurrentControlSet\Control\Lsa\Audit\SpecialGroups logs on.
Key Fields
SidList
The list of special group SIDs assigned to the new logon. Microsoft gives S-1-5-32-544 as an example and documents semicolon-delimited SID lists in the SpecialGroups registry value.
TargetUserName / TargetLogonId / TargetLogonGuid
Identifies the account that performed the logon and supplies correlation keys to 4624, 4648, and 4769.
SubjectLogonId
Hexadecimal logon ID for the account that requested the logon and a join key to nearby authentication events.
Threat Hunting Queries
SecurityEvent
| where EventID == 4964
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc- Data source
- Microsoft Sentinel SecurityEvent table
- Assumptions
- The Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
index=wineventlog source="WinEventLog:Security" EventCode=4964
| table _time, host, user, EventCode, Message- Data source
- Splunk Windows Security event data
- Assumptions
- Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before adding event-specific filtering or aggregation.
dataset = microsoft_windows_raw
| filter edr_event_id = 4964- Data source
- Cortex XDR microsoft_windows_raw
- Assumptions
- The Windows Security channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
title: Windows Security Event ID 4964
status: experimental
logsource:
product: windows
service: security
detection:
selection:
EventID: 4964
condition: selection
falsepositives:
- Legitimate administrative or system activity
level: informational- Data source
- Sigma Windows Security log source
- Assumptions
- This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Documented Values and Codes
| Field | Value | Meaning | Security relevance |
|---|---|---|---|
| SpecialGroups registry path | HKLM\System\CurrentControlSet\Control\Lsa\Audit\SpecialGroups | The configured SID list determines which group memberships cause Event ID 4964 at logon. | Detection coverage depends on this local list; verify configuration before interpreting absence of the event. Source |
| SidList | S-1-5-32-544 | This well-known SID identifies the built-in Administrators group. | A logon carrying an explicitly monitored administrative SID deserves source, logon-type, and account validation. Source |
MITRE ATT&CK Mapping
- T1078.002Valid Accounts: Domain Accounts
Detection Notes
T1078.002 Domain Accounts applies when SidList contains a monitored administrative SID such as S-1-5-32-544 and TargetLogonId joins to a 4624 Logon Type 10 or Type 3 from an unexpected source. Use threshold=1 for SpecialGroups logons on nonadministrative workstations or unusual servers and validate the configured HKLM\System\CurrentControlSet\Control\Lsa\Audit\SpecialGroups list.
Common False Positives
- Normal administrative logons by monitored groups will generate this event by design.
- A broad SpecialGroups registry list can create high volume until the SID list is tuned.
Related Events
Sample Log
EventID: 4964
TargetUserName: dadmin
TargetLogonId: 0x139faf
TargetLogonGuid: {B03B6192-09AE-E77F-DD10-2DC430766040}
SidList: %{S-1-5-32-544}Frequently Asked Questions
What does Windows Event ID 4964 mean?
Event ID 4964 records that a new logon token contains membership in one or more groups configured in the SpecialGroups registry audit list.
Does Windows generate 4964 for every administrator logon by default?
No. The SpecialGroups registry value must contain the SIDs that the organization wants to monitor.
How should 4964 be correlated?
Join TargetLogonId to 4624 and evaluate the account, source address, host, and Logon Type; use TargetLogonGuid for related Kerberos or explicit-credential activity when populated.
Sources
- 4964: Microsoft Windows security auditing event reference
Microsoft · vendor
- Valid Accounts: Domain Accounts (T1078.002)
MITRE ATT&CK · attack
- XDR Collector datasets
Palo Alto Networks · vendor
- Sigma Rules Specification
SigmaHQ · detection rule