Active Directory

How to Audit Special Logons Based on Group Membership in Active Directory

High volumes of Active Directory logon events can make it difficult to identify sign-ins from privileged or sensitive accounts. To address this, Windows records Special Logon events when members of designated security groups sign in. By auditing these events, admins can monitor privileged account activity and detect potential threats early. In this guide, we’ll walk through how to track logons of special group members in Active Directory and monitor sensitive access more effectively.

Audit Special Group Logons in Active Directory Using Event Viewer

Active Directory Permission Required

Event Log Readers Least Privilege

Administrators Most Privilege

Open Server Manager and navigate to Tools » Event Viewer.
From the left pane, navigate to Windows Logs » Security, and select Filter Current Log from the Actions pane.
In the filter window, enter 4964 in the All Event IDs field.
Now, the Event Viewer will display logon events for all members of the configured special groups in Active Directory.
You can double-click any event to open Event Properties page and view details such as account name, logon time, special groups assigned, and more.

Audit Special Group Logons in Active Directory Using Event Viewer

Track Special Group Members' Logons in Active Directory Using PowerShell

Active Directory Permission Required

Event Log Readers Least Privilege

Administrators Most Privilege

The Event Viewer method helps you retrieve special group logon events, but manually reviewing the details of each event one by one can be time-consuming.
To simplify this, you can use Active Directory PowerShell to export group-based special logon events in Active Directory.
Run the cmdlet below by replacing <OutputCSVFilePath> with the location where you want to save the Active Directory special logon report.

Windows PowerShell

 Get-WinEvent -FilterHashtable @{ 
    LogName = 'Security' 
    Id = 4964 
} | Select-Object TimeCreated,@{Name='Username';Expression={$_.Properties[1].Value}},@{Name='Target User SID';Expression={$_.Properties[5].Value}},@{Name='Logon ID';Expression={([xml]$_.ToXml()).Event.EventData.Data | Where-Object {$_.Name -eq 'TargetLogonId'} | Select-Object -ExpandProperty '#text'}},@{Name='Logon Machine';Expression={$_.MachineName}} | 
Export-Csv "<OutputCSVFilePath>" -NoTypeInformation

The special group logons report includes details such as the logon time, username, logon ID, logon machine name, and the special groups assigned.

Track Special Group Members' Logons in Active Directory Using PowerShell

Simple & Quick
Get Active Directory Special Group Member Logons Using AdminDroid

AdminDroid Permission Required Delegated

Any user with report access assigned by the Super Admin

Log in to the AdminDroid Active Directory Companion.
Navigate to the Special Group Members’ Logon Activities report under AD Audit » Special Logons » by Special Group Members.
The report consolidates all special group logon events in a single view, automatically filtering out system and service account logons. It also captures key details like logon account name, logon user domain, special groups assigned, privileges, and more.
To view the logon activities of a specific high-privilege groups, use the Special Groups Assigned filter, choose the group, and click Apply.

Get Active Directory Special Group Member Logons Using AdminDroid

AdminDroid Active Directory Reporter

Never Miss a Sign-in from Critical Active Directory Group Members Using Special Logons!

The AdminDroid Active Directory auditing tool offers comprehensive reports and interactive dashboards for monitoring all group-based special logons in Active Directory. Beyond this, it provides insights into user logon and logoff activity, logon failures, privileged account usage, and other security events to help track sensitive account activity. Here are some key AdminDroid features to monitor and audit special group members’ logons effectively.

Review Special Privileges Logon to Identify Privilege Escalation

Monitor privilege-based Special Logon events alongside privileged group logons to identify sensitive accounts and ensure privileged access is used appropriately in your domain.

Investigate Failed Logons of Special Group Members for Suspicious Activity

Filter the failed logon events in Active Directory report by the username of a special group member to detect potential threats and secure privileged accounts against unauthorized access.

Audit Special Group Logon Table Changes to Detect Unusual Activity

View the special group changes report to monitor SpecialGroups registry modifications, as any unauthorized changes can stop privileged group logons from being recorded in your domain.

Monitor Group Membership Changes to Prevent Missed Special Logons

Leverage ready-to-use membership changes in privileged groups alert template in AdminDroid to get notified instantly whenever a special group’s membership changes, ensuring special logon auditing stays up to date.

Identify Inactive Special Group Members Using Last Logon Activity

Review the users' last logon time in Active Directory report in AdminDroid using Username filter to identify dormant privileged accounts that can be deprovisioned or removed from special groups to minimize the attack surface.

Detect Group SID Changes to Update Special Group Registry

Use the groups with SID history report to identify groups with changed SIDs after migrations and update the SpecialGroups registry with the new SIDs to maintain tracking special logon events.

Overall, AdminDroid’s Active Directory management tool offers comprehensive insights into the special logon activity of special groups. Additionally, it helps monitor privileged accounts, receive alerts on privilege escalation, and remediate inactive Active Directory user accounts to maintain continuous visibility into sensitive account activity.

Explore a full range of reporting options

Download Live Demo

Important Tips

Configure only the SIDs of essential privileged groups in the SpecialGroups Registry to reduce event flooding and improve accuracy of special logon auditing.

Limit membership in privileged groups to only users who require elevated access to improve special logon audit clarity and simplify logon analysis.

Restrict the members of special logon groups to sign in from hardened workstations only to minimize the risk of unauthorized access and lateral movement.

Common Errors and Resolution Steps

The following are possible errors and troubleshooting tips while retrieving special group logons in Active Directory.

Error The Registry Editor cannot rename New Value #1. The specified value name already exists. Type another name and try again.

This error occurs in Registry Editor when you try to create another string value using the same name SpecialGroups.

Fix You can create only one registry value named SpecialGroups. To monitor multiple Active Directory groups, add their SIDs as semicolon-separated values in the existing entry instead of creating a new SpecialGroups value.

Error Get-WinEvent : No events were found that match the specified selection criteria.

This error occurs when there are no events available for special logon based on Active Directory group membership.

Fix If expected events are not appearing, check the following:

Special group SIDs are registered in Registry Editor.
Special Logon auditing is enabled under Advanced Audit Policy.
Policy is refreshed using gpupdate /force or system restart.

If no events appear after verifying these settings, it means no matching logons have occurred yet.

Error Get-ADGroup : The term 'Get-ADGroup' is not recognized as the name of a cmdlet, function, script file, or operable program.

This error occurs when attempting to retrieve the SID of Active Directory groups without importing the Active Directory PowerShell module.

Fix If you are running the command on a Domain Controller, the Active Directory module is already available by default, so you only need to import it. If you are running it from a workstation or member server, install RSAT and import the Active Directory module using the cmdlet below to retrieve the group details.

Import-Module ActiveDirectory

Active Directory

Frequently Asked Questions

Safeguard Privileged Accounts with Special Logon Auditing in Active Directory

What are special groups in Active Directory?

How to add an Active Directory group SID in the Windows registry for special logon auditing?

How to enable special logon auditing in Active Directory?

What is the difference between the special privileges logons and special groups logons?

1. What are special groups in Active Directory?

By default, every successful logon generates Event ID 4624, regardless of whether the user is a standard user or a member of a privileged group. In environments with thousands of daily logons, identifying sign-ins from high-value accounts can be time-consuming and error-prone. Special Group auditing addresses this challenge by generating a dedicated event whenever a member of a monitored group signs in.

Special groups in Active Directory

Special groups are administrator-defined Active Directory security groups whose member logons require additional monitoring. They are commonly used to track sign-ins by privileged groups such as Domain Admins, Enterprise Admins, or any custom security group.

Admins should manually define which groups should be monitored by adding their Security Identifiers (SIDs) to the SpecialGroups registry value on Windows systems.

How does group-based Special Logon auditing works?

When a user logon, Windows evaluates the user’s security token and checks whether it contains any of the configured special group SIDs.

If a match is found, Windows generates Event ID 4964 (special groups have been assigned to a new logon), indicating that the user belongs to one or more monitored groups. This dedicated event enables admins to quickly identify logons by members of selected groups without filtering through countless Event ID 4624 entries. It can also be correlated with other security events during investigations and root cause analysis.

In this way, special group auditing simplifies this process by providing a focused view of high-importance logon activity, improving visibility and reducing manual effort.

2. How to add an Active Directory group SID in the Windows registry for special logon auditing?

To enable Special Logon auditing for specific Active Directory groups, admins must manually define the SIDs groups they want to monitor in the Windows Registry. This is a critical configuration step, as only the groups whose SIDs are registered are considered during Special Logon auditing.

Below are the steps to add the SID of an Active Directory group in Windows Registry:

Open Registry Editor from the Start menu or press (Win+R), type regedit, and hit Enter.
Navigate to HKEY_LOCAL_MACHINE » SYSTEM » CurrentControlSet » Control » Lsa » Audit.
Right-click the Audit folder, select New » String Value, enter SpecialGroups as the string value name, and press Enter. Ensure the name is entered exactly as specified.
Right-click SpecialGroups, select Modify, and in the Value data box, paste the SIDs of the target Active Directory groups separated by semi-colon.

Note: Active Directory group SIDs differ across domains. You can retrieve the SIDs of the Active Directory groups in your environment running the below PowerShell cmdlet.

Get-ADGroup -Filter * | Select-Object Name, SID

3. How to enable special logon auditing in Active Directory?

Adding SIDs to the SpecialGroups registry value is only the first step in tracking logons by members of the configured groups. To track special logon events in Active Directory, the special logon audit policy must also be enabled. Without this audit policy, Windows will not log Event ID 4964, even if the special groups are configured.

Follow the steps below to enable the audit special logon policy in Active Directory.

Open the Group Policy Management console from the Start menu or press (Win + R), type gpmc.msc, and hit Enter.
Expand the Forest, then expand Domains. You can either edit an existing GPO or create a new GPO based on your requirement. Then, right-click the target GPO and select Edit.
In the Group Policy Management Editor, navigate to Computer Configuration » Policies » Windows Settings » Security Settings.
Under Advanced Audit Policy Configuration, expand Audit Policies and select Logon/Logoff.
Right-click Audit Special Logon and select Properties.
Enable Configure the following audit events and select Success. Click Apply and then OK. Since Special Logon events are recorded only for successful logons, auditing failure events is not required.

The Special Logon audit policy is now enabled, and logon events will be recorded. Once enabled, every logon by a member of the specified group is recorded as a Special Logon event.

By default, Group Policy is updated every 90 minutes with a random offset. To force the policy changes to take effect immediately, run gpupdate /force in Command Prompt.

4. What is the difference between the special privileges logons and special groups logons?

Special Group Logon and Special Privilege Logon are often mistaken for the same thing in Active Directory, but they serve different purposes. Windows Security Auditing distinguishes them by monitoring two different aspects of a logon: one based on group membership and the other based on assigned user privileges.

Special groups logons identify users who belong to specific Active Directory groups that are explicitly registered for monitoring. In contrast, Special Privileges logons identify accounts that are granted sensitive privileges at the time of logon, regardless of group membership.

Let’s look at their differences in detail.

Characteristics	Special Groups Logons	Special Privileges Logons
When it occurs	When a user logs on and their group membership SID matches a SID configured in the SpecialGroups registry value.	When a user logs on and is assigned sensitive user rights (privileges) such as SeDebugPrivilege, SeTcbPrivilege, SeBackupPrivilege, etc.
What it checks	Who you are – Identifies users based on their membership in monitored security groups.	What you can do – Identifies users based on the sensitive privileges assigned to their accounts.
Configuration required	Requires manual registration of group SIDs in the Registry along with enabling special logon audit policy.	Requires enabling of special logon auditing only.
Event ID generated	4964	4672
Typical use case	Highlight logons by privileged Active Directory group members for enhanced monitoring.	Monitor logons where high-level sensitive privileges are assigned to users to detect and prevent unauthorized privilege escalation.