Event ID: 12 -User Type

Question

If you look at an Event Viewer Event ID: 12 report is there any information in a report to enable you to determine whether the user logging on has Administrators rights or is a user with lesser rights?
TIA, Gerry

Answer 1

Blair
Is it normal within a single session to see a Security UserID change from ="S-1-5-18" ="S-1-5-19"?
 Log Name:     
System
Source:        Microsoft-Windows-Kernel-General
Date:          17/12/2013 00:57:39
Event ID:      12
Level:         Information
User:          SYSTEM
Description:
The operating system started at system time ‎2013‎-‎12‎-‎17T00:57:39.500000000Z.
Event Xml:
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="MajorVersion">6</Data>
    <Data Name="MinorVersion">1</Data>
    <Data Name="BuildVersion">7601</Data>
    <Data Name="QfeVersion">18247</Data>
    <Data Name="ServiceVersion">1</Data>
    <Data Name="BootMode">0</Data>
Log Name:     
System
Source:        Microsoft-Windows-TBS
Date:          17/12/2013 00:58:40
Event ID:      537
Level:         Information
User:          LOCAL SERVICE
Description:
A compatible Trusted Platform Module (TPM) Security Device cannot be found on this computer. 
TBS could not be started.
    <Provider Name="Microsoft-Windows-TBS" Guid="{51480C1A-90AA-416E-98FD-4C11F735349B}" />
    <Security UserID="S-1-5-19" />
TIA, Gerry