Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To audit user and device claims in Windows logon tokens, deploy the device-scoped Audit User Device Claims policy through an Intune Windows custom profile, and enable the separate Audit Logon subcategory. The resulting claims information is recorded as Security event 4626 on the computer that creates the logon session—not necessarily the device the user is sitting at.
What this Intune policy does
The Audit Policy CSP describes the setting this way: “This policy allows you to audit user and device claims information in the user’s logon token.” Microsoft Learn: Policy CSP – Audit
It controls whether Windows audits claims in a logon token. It does not create claim attributes, enable Dynamic Access Control, or configure compound authentication in Active Directory. Those identity and resource prerequisites must be handled separately.
The policy is device-scoped. Microsoft lists Windows Pro, Enterprise, Education, IoT Enterprise, and IoT Enterprise LTSC as applicable editions. Its displayed applicability starts with Windows 10 version 1803 with the specified update and later listed releases. The setting page does not provide a separate Windows 11 minimum in that applicability row, so verify support for the Windows versions in your fleet before deployment.
#1 Best Overall
Configure the setting in Intune
- Check scope and prerequisites. Identify the target Windows devices and determine whether user claims, device claims, or both are configured in Active Directory. Device claims require compound identity to be enabled for the domain and the logon computer.
- Open or create a Windows configuration profile. In the Intune admin center, use a Windows custom profile that supports OMA-URI settings. Microsoft notes that many settings are available through Settings Catalog or device restriction profiles; check your tenant for this setting before choosing a custom entry. The cited documentation does not establish whether it appears in every tenant’s catalog. See Microsoft’s instructions for adding custom Windows settings in Intune.
- Add Audit User Device Claims. Enter the OMA-URI
./Device/Vendor/MSFT/Policy/Config/Audit/AccountLogonLogoff_AuditUserDeviceClaims, set the data type to Integer, and choose the value that matches your audit requirement. - Enable Audit Logon separately. Audit Logon is a prerequisite for claims events; configuring the claims subcategory alone is not sufficient.
- Assign and validate. Assign the profile to an appropriate device group. After devices receive policy, check the Security log on the computer responsible for creating a test logon session and confirm that event 4626 is present. Start with a representative group before expanding deployment.
Choose an audit value
| Integer | Policy behavior |
|---|---|
| 0 | Off / None (default) |
| 1 | Success |
| 2 | Failure |
| 3 | Success and Failure |
The Group Policy equivalent is Audit User Device Claims at Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Logon/Logoff. Intune’s OMA-URI setting is device-scoped; do not configure it as a user-scoped policy.
Find and interpret event 4626
Microsoft identifies Security event ID 4626 as “User/Device claims information.” Events are generated on the computer where Windows creates the logon session:
- Interactive logon: Check the computer the user signed into.
- Network access, such as a shared folder: Check the computer hosting the resource, because that computer creates the session for the access.
The event may include user claims when the user’s Active Directory account attributes contain claims, and device claims when the computer account attributes contain claims. A successful logon can generate one or more audit events; Windows may create multiple events if the information does not fit in one. Microsoft characterizes event volume as low on a client computer and medium on a domain controller or network server. These are qualitative descriptions, not estimates of event counts for a particular environment. See Microsoft’s Advanced Audit Policy Configuration settings.
Check the Active Directory claims prerequisites
Enabling auditing does not make claims appear in the token. User and device claims depend on their corresponding Active Directory account attributes. For the documented device-claims behavior, compound identity must be enabled for the domain and the computer where the user logs on.
Rank #3
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Hardbound book with Black imitation leather cover and stamped with “VISITORS REGISTER”
- Archival quality, acid-free paper, with space for up to 2,280 entries and includes a convenient placeholder ribbon
- Page Dimensions: 8 7/8” width x 7” height (22.5cm x 17.8cm); landscape format; Section sewn, Archival Quality Binding-book lies flat when open
- Reorder SKU: LOG-120-Visitor-A-LKT34
Claims reaching resource domain controllers also depend on Dynamic Access Control. Device claims have additional requirements, including device-domain support and a resource configured for compound authentication. Microsoft’s protected accounts configuration guidance explains this identity and authentication context.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Distinguish claims auditing from group membership auditing
Audit User Device Claims and Audit Group Membership are separate subcategories. Event 4626 records user/device claims information; event 4627 records group membership information. Enabling one does not substitute for the other. Microsoft’s advanced audit policy reference identifies both event IDs and the Audit Logon dependency.
Quick Recap
Best Value
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Hardbound book with burgundy imitation leather cover and stamped with “GUESTS”
- Archival quality, acid-free paper, Section sewn - book lies flat when open
- Page Dimensions: 8 7/8” width x 7” height (22.5cm x 17.8cm); landscape format Features space for up to 1,320 entries and includes a convenient placeholder ribbon
- Reorder SKU: LOG-120-GUEST-A-LKT25
Rank #4
- EASY TO USE - The inventory and sales log book are easy-to-use inventory books that help you track inventory, purchases, sales, balances, unit and total costs, and manage reorders - all in one place. Easy track your inventory for small businesses.
- MONITOR YOUR DATAS - Using a sales inventory book to store all your data, you can consult your records whenever needed. Optimize your business and generate the most benefit.
- UNIQUE DESIGN - We make sure you can tailor this inventory log book to your enterprise business needs to take full advantage of its capabilities. It will work for online, consignment, home or in-store businesses.
- HIGH QUALITY - This sales book for your business, sales book size of 5.8" x 8.5", just the perfectly size to fit in your backpack, purse or laptop case. Is used to high quality 100gsm pure white paper, elastic band and a back pocket for extra space.
- THE PERFECT GIFT - Use inventory and sales log book for your personal or samll business finances, give it to your friends, family as a gift for Birthday| Easter|Children's Day|Halloween|Thanksgiving|Christmas|Back to school and New Year's Day.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →
