Event ID 4608SystemP3

Windows Event ID 4608: Windows is starting up

Windows Security Event ID 4608 records startup of LSASS and initialization of the auditing subsystem.

Applicable version: Windows Server 2008 and later where the audit subcategory is enabled
Last reviewed: 2026-07-13

Trigger Scenarios

Microsoft documents that this event is logged when LSASS.EXE starts and the auditing subsystem initializes, typically during OS startup.

Key Fields

EventID / TimeCreated

Startup timestamp for the audited system, used to anchor boot timelines.

Computer

The host whose auditing subsystem initialized.

Sequence with 4609

Compare with 4609 shutdown and uptime expectations to identify unexpected reboots.

Common False Positives

Normal OS startup after planned maintenance or patching.
Lab and workstation reboots create routine 4608 events.

Related Events

MITRE ATT&CK Mapping

T1529System Shutdown/Reboot

Detection Notes

Use threshold=1 unexpected 4608 outside a maintenance window on servers where reboot should be rare. Microsoft documents 4608 as LSASS/auditing subsystem startup; if no matching 4609 or approved reboot exists and the host later shows cleared logs or service changes, the sequence can support T1529 System Shutdown/Reboot. Correlate TimeCreated with 4616 time changes, 1102 audit-log clears, and service-start events.

Microsoft Sentinel KQL

SecurityEvent
| where EventID == 4608
| project TimeGenerated, Computer

Splunk SPL

index=wineventlog EventCode=4608 | table _time, host

Sample Log

EventID: 4608
Computer: DC01
TimeCreated: 2026-07-13T03:10:00Z

Source

Official documentation Machine-readable JSON