Windows Event ID 4621: Administrator recovered system from CrashOnAuditFail
Windows Security Event ID 4621 records that an administrator recovered a system after CrashOnAuditFail halted it because auditable activity could not be recorded.
- Applicable version
- Windows Server 2008 and later; Windows Vista and later
- Last reviewed
- 2026-07-13
Trigger Scenarios
The event is logged after reboot when CrashOnAuditFail equals 2 and users who are not administrators are allowed to log on again.
Key Fields
Value of CrashOnAuditFail
The reported value. Microsoft states the event generates when CrashOnAuditFail = 2, meaning the system had halted after failing to record an auditable event.
Computer
The recovered host. Prioritize domain controllers, jump servers, and systems where losing Security log coverage affects incident reconstruction.
TimeCreated
The reboot/recovery time. Use it to define the period where audit records may be incomplete.
Common False Positives
- Disk-full, log-service, or operating-system failures can trigger CrashOnAuditFail without malicious activity.
- Recovery after planned maintenance may create this event if the host previously exhausted audit logging.
Related Events
MITRE ATT&CK Mapping
- T1685.001Disable or Modify Tools: Disable or Modify Windows Event Log
Detection Notes
Microsoft recommends alerting on any 4621; use threshold=1 because CrashOnAuditFail = 2 means the host halted after it could not record an auditable event. In T1685.001 triage, that value proves Security Log coverage was disrupted before recovery, so review 4612 audit-discard events, disk/log health, and any 4719 or 1102 events before the reboot to distinguish resource failure from intentional logging impairment.
SecurityEvent
| where EventID == 4621
| project TimeGenerated, Computer, EventDataindex=wineventlog EventCode=4621
| table _time, host, MessageAdministrator recovered system from CrashOnAuditFail.
Value of CrashOnAuditFail: 2
Computer: DC01