SOC Event Lookup
Event ID 4611LSAP3

Windows Event ID 4611: A trusted logon process has been registered with the LSA

Windows Security Event ID 4611 records that a logon process has been confirmed as trusted by the Local Security Authority and can submit logon requests.

Applicable version
Windows Server 2008 and later; Windows Vista and later
Last reviewed
2026-07-13

Trigger Scenarios

The event typically appears during operating-system startup or authentication activity when trusted logon processes register with LSA.

Key Fields

Subject\Security ID

Microsoft recommends reporting this event when the subject is not SYSTEM. SYSTEM registrations commonly appear with Logon ID 0x3e7; any user or service SID outside that baseline requires review.

Logon Process Name

The registered logon process name. Microsoft examples include Winlogon; an unapproved value means LSA will accept logon requests from a new source.

Subject\Logon ID

Hexadecimal correlation value. Use 0x3e7 as the common SYSTEM logon session baseline, and pivot to 4624 events with the same value if the registering account is unexpected.

Common False Positives

  • Normal boot and interactive logon activity registers expected trusted logon processes.
  • Endpoint security, credential provider, or remote-access products may register approved logon components.

Related Events

MITRE ATT&CK Mapping

  • T1556Modify Authentication Process

Detection Notes

Microsoft recommends reporting 4611 when Subject\Security ID is not SYSTEM; use the SYSTEM Logon ID 0x3e7 and known Logon Process Name values such as Winlogon as the baseline. A non-SYSTEM subject registering a new logon process is a T1556 signal because LSA will accept authentication requests from that process, so correlate by Subject\Logon ID to 4624 and by host to recent 4610 or 4614 package loads.

Microsoft Sentinel KQL
SecurityEvent
| where EventID == 4611
| where SubjectUserSid != "S-1-5-18"
| project TimeGenerated, Computer, SubjectUserName, SubjectUserSid, SubjectLogonId, LogonProcessName
Splunk SPL
index=wineventlog EventCode=4611 NOT SubjectUserSid="S-1-5-18"
| table _time, host, SubjectUserName, SubjectUserSid, SubjectLogonId, LogonProcessName
Sample Log
Subject:
  Security ID: CORP\svc-auth
  Account Name: svc-auth
  Logon ID: 0x45ab1
Logon Process Name: CustomAuth

Source

Official documentationMachine-readable JSON