| Event Id | 600 |
| Source | Security |
| Description | A process was assigned a primary token. Assigning Process Information: Process ID: < Process ID> Image File Name: < Image File Name> Primary User Name: < Primary User Name> Primary Domain: < Primary Domain> Primary Logon ID: < Primary Logon ID> New Process Information: Process ID: < Process ID> Image File Name: < Image File Name> Target User Name: < Target User Name> Target Domain: < Target Domain> Target Logon ID: < Target Logon ID> |
| Event Information | According to Microsoft: Cause: A program requested and generated a security token. This usually indicates that the program is running in a specific security context. After the program generates the security token, it accesses resources in the security context of that token. Resolution: If this message appears infrequently, no user action is required. If this message appears frequently within a short time period, the specified program might be running with elevated or unauthorized security privileges. Verify that the program starts in the appropriate security context and that it has the rights to perform all necessary actions. |
| Reference Links | Event ID 600 from Source Security Alternate Event ID in vista and Windows 2008 server is 4696 Security Event for Associating Service Account Logon Events |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.