Event ID 4648 is logged when a process attempts to log on using explicit credentials, such as with scheduled tasks or RUNAS, and it can also appear during normal operating system activity. It requires Audit Logon subcategory. Review Subject Account Name, Target Server Name, Process Name, and Network Address to distinguish legitimate administration from abuse.
What Event ID 4648 actually means in Windows auditing
Event ID 4648 is the Windows signal for explicit credential use. Practically, it tells you a process supplied credentials for a logon attempt rather than relying on the current session token alone. That makes it useful for spotting administrative activity, task automation, and some forms of credential abuse, but it is not automatically suspicious on its own.
The event becomes meaningful when you read it alongside the surrounding context. A scheduled task, remote administration workflow, or RUNAS execution can all produce the same event pattern as a more questionable action, so the value is in matching the log entry to the intended operational behavior. The event is only available when the relevant audit setting is enabled, so logging gaps matter as much as the event itself.
For a broader Windows event-log view, the event fits into the same defensive workflow covered in the Windows Event Log Guide, which helps place 4648 alongside related logon and account-use signals.
Where 4648 appears in legitimate administration and automation
Legitimate use is common in environments where an operator or process must present alternate credentials to reach a remote host, launch a tool, or run a task under a different security context. That includes scheduled tasks, service-driven execution paths, and direct operator use of RUNAS or similar administrative workflows. The event itself does not say the action was bad, only that explicit credentials were supplied.
Normal operating system activity can also generate 4648, so the key question is whether the process name, account name, target server, and network address line up with your expected administration patterns. If the values point to a known management host or a standard automation account, the event may be routine. If they point to an unusual source, an unexpected process, or an unapproved server, the same log line becomes a lead.
When you investigate legitimate use, compare the event to the approved path for the system or tool. Explicit credential events should usually have a clear owner, a known purpose, and a repeatable pattern. If those three elements are missing, the event deserves closer review even if it is not obviously malicious.
How to interpret 4648 as an abuse signal
Because Event ID 4648 records explicit credential submission, it can surface attempts to reuse credentials outside their normal workflow. That makes it valuable for identifying suspicious administrative impersonation, lateral movement, and process masquerading. The strongest clues are mismatches between the initiating process, the destination server, and the user context that should have generated the action.
A 4648 event is especially important when it appears near other access anomalies, such as unusual logon locations, repeated authentication failures, or administrative use outside change windows. If the same account appears across multiple systems with different network origins, the event may indicate that a credential has been harvested and is being replayed. The event does not prove compromise, but it can confirm that a process had access to a secret worth protecting.
For process and network correlation, many teams pair Windows auditing with Sysmon telemetry. The Sysmon Guide is useful here because it helps connect process creation and network activity to the credential event you are reviewing. If PowerShell is involved in the workflow, the PowerShell Security Guide provides the logging context that often explains whether the action was administrative or suspicious.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-2 — Audit Events | Event 4648 is only useful when explicit logon auditing is enabled and reviewed. |
| AU-12 — Audit Generation | The event depends on generating the right audit record at the source system. | |
| Recommendation — Define and review the logon events needed to detect explicit credential use. Enable audit generation for logon activity that reveals alternate credential use. | ||
| MITRE ATT&CK | T1078 — Valid Accounts | Explicit credential logons can indicate use of stolen or abused valid credentials. |
| Recommendation — Correlate 4648 with valid-account abuse indicators and adjacent access events. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | The question is about a Windows audit event and how to use it correctly. |
| Recommendation — Centralize and review Windows audit logs so explicit credential use is visible. | ||
Practitioner Guidance
What to verify: Confirm that Audit Logon subcategory is enabled and that the event lines up with an approved administrative path. If the process name or network address does not match a known workflow, treat the record as investigative evidence rather than harmless noise.
Decision rule: If the event is tied to a privileged account, a remote target, or a process that should never need alternate credentials, prioritize correlation and blast-radius assessment over simple log review. If it maps cleanly to a known task or operator action, document the exception pattern so future alerts can be judged faster.
Common mistake: Teams often dismiss 4648 because it can occur during ordinary system activity. That is risky, because the same event is also one of the few clear traces that a process intentionally presented credentials, which is exactly why it matters during lateral-movement investigations.
Practitioner takeaway: Treat 4648 as a context event, not a verdict. Its value comes from proving that explicit credentials were used, then testing whether that use matches the expected process, target, and administrative pattern.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org