Event ID 4648 — Connection with explicit identifiers

One process attempted to, use explicitly provided identifiers.

Source of event

Microsoft-Windows-Security-Auditing — Security category.

Possible causes

• Runas command
• Access to a resource with another account
• Script or of administration tool

Verifications to be carried out

1. Identify Process Name
2. Compare Subject Account and Account attorneyateto Patent
3. Check Target Resource

Useful orders….

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4648} -MaxEvents 30

To be retained….

An Event ID must always be interpreted with its source, its full message, its timing and the context of the system. The same number may exist in several providers of events.