Windows event ID 4672 - Special privileges assigned to new logon