4621 Security log · System high severity low volume

Windows Event ID 4621 — Administrator recovered system from CrashOnAuditFail

System was recovered from CrashOnAuditFail state. This occurs when audit policy is set to crash system if audit log is full and the log has filled.

Why event 4621 matters

CrashOnAuditFail (HKLM\SYSTEM\CurrentControlSet\Control\Lsa\CrashOnAuditFail=2) means an audit log full caused a crash. Attackers may deliberately fill audit logs to cause crashes and disrupt monitoring.

How to detect it

Alert on any occurrence. Investigate why audit log filled — possible log flooding attack.

Log source
Security
Advanced Audit Policy — enable the 'System' subcategory (Success and/or Failure).
Fields to pivot on
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName

MITRE ATT&CK mapping

Tactic Technique
Defense Evasion Disable Windows Event Logging (T1562.002)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL
SecurityEvent
| where EventID == 4621   // Administrator recovered system from CrashOnAuditFail
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Security" EventCode=4621
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# Administrator recovered system from CrashOnAuditFail — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`
Hunt event 4621 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Related System events

4608 Windows is starting up 4616 The system time was changed

Frequently asked questions

What is Windows Event ID 4621?

Administrator recovered system from CrashOnAuditFail. System was recovered from CrashOnAuditFail state. This occurs when audit policy is set to crash system if audit log is full and the log has filled.

Which log records event 4621?

Event 4621 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'System' subcategory (Success and/or Failure).

What MITRE ATT&CK techniques map to event 4621?

Event 4621 is associated with: Disable Windows Event Logging (T1562.002).

How do you detect activity around event 4621?

Alert on any occurrence. Investigate why audit log filled — possible log flooding attack.