Question

While reviewing the Windows Security event log on a domain controller after a suspected compromise, an analyst finds Event ID 4672 recorded immediately after a successful interactive logon for a standard help-desk account that should never have administrative rights. What does the presence of this event most directly indicate the analyst should investigate?

Accepted Answer

The account was assigned special (administrative-equivalent) privileges at logon, suggesting possible privilege abuse or misconfiguration

Answer

The account's password was changed by an administrator during the session

Answer

A new user account was created on the domain controller

Answer

The account failed to authenticate multiple times before locking out