| Event Id | 609 |
| Source | Security |
| Description | User Right Removed: User Right: %1 Removed From: %2 Removed By: User Name: %3 Domain: %4 Logon ID: %5 |
| Event Information | According to Microsoft Cause: This event record indicates that a specific right assigned to the identified user was removed. Resolution: The person with administrative rights for the computer should make sure the user right assigned was supposed to be removed. |
| Reference Links | "Event Id 609 of Source security " Alternate Event ID in Vista and Windows Server 2008 is 4705. |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.