Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteTo audit user and device claims in Windows logon tokens with Intune, deploy the device-scoped Audit Policy CSP setting AccountLogonLogoff_AuditUserDeviceClaims through a Windows custom profile and enable the separate Audit Logon subcategory. The resulting claims-information event is Security event 4626, written on the computer that creates the logon session.
What this Intune policy does—and what it does not do
The setting records user and device claims information present in a user’s Windows logon token. It controls auditing only: it does not create claims, populate Active Directory attributes, enable Dynamic Access Control, or configure compound authentication. Those identity and resource prerequisites must be handled separately.
As an Amazon Associate I earn from qualifying purchases.
User claims can be included when the user’s Active Directory account attributes contain claims; device claims can be included when the computer account attributes contain them. For the documented claims-auditing behavior, compound identity must be enabled for the domain and the computer where the user logs on. Microsoft’s Audit Policy CSP documentation describes the setting as auditing user and device claims information in the user’s logon token.
Check scope and Windows applicability
This is a device-scoped policy, not a user-scoped setting. Select the target Windows devices before creating the assignment. Microsoft lists Windows Pro, Enterprise, Education, IoT Enterprise, and IoT Enterprise LTSC. The setting’s displayed applicability begins with Windows 10 version 1803 with the specified update and later listed releases. The applicability row does not state a distinct Windows 11 minimum, so verify current support for the Windows versions in your fleet rather than assuming a separate minimum.
#1 Best Overall
- Connectivity: Includes WiFi, Bluetooth, and LAN for wireless and wired connections
- Memory: Features 16GB DDR4 RAM for smooth multitasking and performance
- Storage: Combines 500GB SSD and 1TB HDD for ample storage space
- Graphics: Integrated Intel UHD Graphics 630 for crisp visuals and video playback
- Design: Sleek desktop tower with black color and slim profile for modern look
Configure the setting in Intune
- Check built-in settings first. In the Intune admin center, check the Settings Catalog and device restriction profiles for the setting in your tenant. Microsoft notes that many CSP settings are built into these profile types, but availability of this particular setting in a given tenant is not established. If it is not available, use a Windows custom profile with OMA-URI as described in Microsoft’s instructions for adding custom Windows settings.
- Create or open a Windows custom profile. Add a custom OMA-URI setting for the target Windows devices.
- Enter the claims audit setting. Use the following values:
- OMA-URI:
./Device/Vendor/MSFT/Policy/Config/Audit/AccountLogonLogoff_AuditUserDeviceClaims - Data type:
Integer - Value: choose the audit behavior from the value table below.
- OMA-URI:
- Enable Audit Logon as well. Claims events require the separate Audit Logon subcategory to be enabled. Configure it through your applicable audit-policy management method; the claims OMA-URI alone is not sufficient. Microsoft’s Advanced Audit Policy Configuration guidance documents this dependency.
- Assign and validate. Assign the profile to an appropriate device group. Begin with representative devices, allow them to receive policy, and check the Security log on the computer that creates the session for event 4626.
Choose the integer value
| Value | Audit behavior |
|---|---|
0 |
Off / None (default) |
1 |
Success |
2 |
Failure |
3 |
Success and Failure |
The equivalent Group Policy setting is Audit User Device Claims under Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Logon/Logoff.
Find the claims event in the right Security log
Microsoft identifies event ID 4626 as “User/Device claims information.” Events are generated on the computer where the logon session is created, not necessarily on the computer where an administrator expects to find them.
Rank #2
- [INTEL POWERED CONTENT] - Built with a 8th Generation Hexa-Core Intel i5 and 32GB of DDR4 RAM; Modern, Windows 11 ready, with 4K support, Executive multitasking, media streaming and smooth, multi-tab web browsing; Perfect as an all-purpose multimedia computer; built for content creators; Plenty of RAM and Mass storage for photo and video editing powered by Intel HD 630
- [LATEST WIRELESS TECH] - This Dell Desktop Computer easily connects to the internet through the Built In WiFi / Bluetooth
- [SOLID STATE STORAGE] - This Dell Computer setup comes with an ultra-fast 1TB Solid State Drive (SSD); Setup as the primary boot device; Boot and load programs with lightning speed ; Additional expansion available
- [BUY & OWN WITH CONFIDENCE] - From the world's largest Microsoft Authorized Refurbisher; Quality Guarantee and Free Tech Support; Award-winning Customer Service; | Support Sustainable Business
- [MODERN HI-SPEED PORTS] - USB 3.0 (x4) | USB 2.0 (x4) | DisplayPort (x1) | HDMI Port (x1) | Audio Combo Jack (x1) | Audio Out (x1) | RJ-45 Ethernet (x1) | Internal SATA (x3)
- Interactive sign-in: check the Security log on the computer the user signed into.
- Network access, such as a shared folder: check the Security log on the computer hosting the resource.
A successful logon can generate one or more audit events. Multiple events may be produced when the claims information does not fit in a single event. Microsoft characterizes event volume as low on a client computer and medium on a domain controller or network server; these are qualitative planning descriptions, not a forecast of a particular environment’s event counts.
Keep claims auditing distinct from group-membership auditing
Audit User Device Claims and Audit Group Membership record different information. Event 4626 is for user/device claims; event 4627 is for group membership. Enabling one should not be treated as a substitute for the other.
Rank #3
- Model: Dell OptiPlex 7050 Small Form Factor (SFF)
- Processor: Intel Core i7-7700 3.60 GHz
- Memory: 32GB DDR4 Ram
- Storage: 1TB Solid State Drive (SSD) Fast Boot + Storage
- Operating System: Windows 11 Pro (64-bit)
Account for Active Directory and resource prerequisites
Intune can deliver the audit policy, but it cannot supply the claims being audited. Microsoft’s protected-account configuration guidance explains that user claims, device claims, and device security groups have separate requirements. Claims reaching resource domain controllers require Dynamic Access Control; device claims also depend on device-domain support and a resource configured for compound authentication. If event 4626 is present but does not contain the expected claims, check the identity attributes and those domain, computer, and resource configurations rather than treating the audit policy as a claims-provisioning mechanism.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
