Windows Event ID 4608 – Security: Windows System Startup Initialization

Check the Security log to confirm Event ID 4608 is logging properly during system startup.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Look for Event ID 4608 with source Microsoft-Windows-Security-Auditing
4. Verify the timestamp corresponds to your last system boot time
5. Check the event details to ensure LSASS initialization completed successfully

Use PowerShell to query recent startup events:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4608} -MaxEvents 5 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

Examine the boot sequence by correlating Event ID 4608 with other system startup events.

1. Open PowerShell as Administrator
2. Query multiple startup-related events to build a timeline:

# Get startup events from multiple logs
$StartupEvents = @()
$StartupEvents += Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4608} -MaxEvents 3
$StartupEvents += Get-WinEvent -FilterHashtable @{LogName='System'; Id=6005,6006,6009} -MaxEvents 10
$StartupEvents += Get-WinEvent -FilterHashtable @{LogName='System'; Id=1074} -MaxEvents 5

# Sort by time and display
$StartupEvents | Sort-Object TimeCreated -Descending | Format-Table TimeCreated, LogName, Id, LevelDisplayName, Message -Wrap

3. Look for Event ID 6005 (Event Log service started) which should appear close to 4608
4. Check for Event ID 6009 (system boot information) for additional context
5. Verify no unexpected gaps in the timeline that might indicate issues

Verify that security auditing is properly configured to ensure Event ID 4608 continues logging.

1. Check current audit policy settings:

# Check audit policy for system events
auditpol /get /category:"System" /r | ConvertFrom-Csv | Format-Table

2. Verify Security State Change auditing is enabled:

# Specifically check Security State Change subcategory
auditpol /get /subcategory:"Security State Change"

3. If auditing is disabled, enable it:

# Enable Security State Change auditing
auditpol /set /subcategory:"Security State Change" /success:enable /failure:enable

4. Check Group Policy settings that might affect auditing:
5. Navigate to Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration
6. Verify System → Audit Security State Change is configured

Troubleshoot scenarios where Event ID 4608 is missing or appears at unexpected times.

1. Check if the Security log is full or has size limitations:

# Check Security log configuration
Get-WinEvent -ListLog Security | Select-Object LogName, FileSize, MaximumSizeInBytes, RecordCount, IsEnabled

2. Verify LSASS service status and startup type:

# Check LSASS service (it should not appear as a service, but check related services)
Get-Service | Where-Object {$_.Name -like "*lsa*" -or $_.DisplayName -like "*Local Security*"}

# Check Event Log service which is critical for logging
Get-Service EventLog | Format-List *

3. Review System log for LSASS-related errors:

# Look for LSASS or security-related errors during boot
Get-WinEvent -FilterHashtable @{LogName='System'; Level=2,3} -MaxEvents 50 | Where-Object {$_.Message -like "*lsass*" -or $_.Message -like "*security*"} | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

4. Check for system clock issues that might affect event timestamps:

# Compare system time with domain controller (if domain-joined)
w32tm /query /status
w32tm /query /peers

Perform detailed forensic analysis using Event ID 4608 as a baseline for security investigations.

1. Create a comprehensive startup event correlation script:

# Advanced startup analysis script
$LastBoot = (Get-CimInstance -ClassName Win32_OperatingSystem).LastBootUpTime
$BootWindow = $LastBoot.AddMinutes(-5)..($LastBoot.AddMinutes(10))

# Collect all relevant events around boot time
$SecurityEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; StartTime=$LastBoot.AddMinutes(-2); EndTime=$LastBoot.AddMinutes(5)} -ErrorAction SilentlyContinue
$SystemEvents = Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=$LastBoot.AddMinutes(-2); EndTime=$LastBoot.AddMinutes(5)} -ErrorAction SilentlyContinue

# Find Event ID 4608 and analyze surrounding events
$Event4608 = $SecurityEvents | Where-Object {$_.Id -eq 4608} | Select-Object -First 1

if ($Event4608) {
    Write-Host "Event ID 4608 found at: $($Event4608.TimeCreated)" -ForegroundColor Green
    Write-Host "System boot time: $LastBoot" -ForegroundColor Yellow
    Write-Host "Time difference: $(($Event4608.TimeCreated - $LastBoot).TotalSeconds) seconds" -ForegroundColor Cyan
} else {
    Write-Host "Event ID 4608 NOT FOUND - Potential issue!" -ForegroundColor Red
}

2. Export startup events for detailed analysis:

# Export startup events to CSV for analysis
$AllStartupEvents = @()
$AllStartupEvents += Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4608,4609} -MaxEvents 10 -ErrorAction SilentlyContinue
$AllStartupEvents += Get-WinEvent -FilterHashtable @{LogName='System'; Id=6005,6006,6009,1074} -MaxEvents 20 -ErrorAction SilentlyContinue

$AllStartupEvents | Sort-Object TimeCreated -Descending | Export-Csv -Path "C:\temp\startup_analysis.csv" -NoTypeInformation

3. Check for potential security anomalies:

# Look for security events that predate Event ID 4608 (potential clock manipulation)
$SuspiciousEvents = Get-WinEvent -FilterHashtable @{LogName='Security'} -MaxEvents 1000 | Where-Object {
    $_.TimeCreated -lt $Event4608.TimeCreated -and
    $_.TimeCreated -gt $LastBoot.AddMinutes(-30)
}

if ($SuspiciousEvents) {
    Write-Host "WARNING: Found $($SuspiciousEvents.Count) security events that predate Event ID 4608!" -ForegroundColor Red
    $SuspiciousEvents | Format-Table TimeCreated, Id, Message
}