Generic Windows Security Log Event ID 4673 (or 4674)

Privilege Escalation Attempt Blocked – 3 Fast Fixes

EP
Erropedia Team
📅 June 24, 2026 📅 Updated Sep 26, 2026 👁 62 views Cybersecurity & Malware Intermediate
Your PC or server blocked a privilege escalation attempt. This guide covers the three most common causes and fixes so you can stop the alerts fast.

1. Misconfigured Application Requesting Unneeded Admin Rights

This is the most common reason you see a "Privilege Escalation Attempt Blocked" alert. An app you actually trust is asking for more permissions than it needs. This happens a lot with older software like QuickBooks 2018, Adobe Creative Cloud, or even some business tools like TeamViewer.

The fix is simple: give that app the rights it needs, but in a safe way.

  1. Right-click the app's shortcut (not the main program file yet).
  2. Select Properties.
  3. Click the Compatibility tab.
  4. Check the box that says Run this program as an administrator.
  5. Click Apply, then OK. You should see the icon change slightly – a small shield icon appears over the app's icon.
  6. Now the app will always ask for admin rights properly. The privilege escalation alert should stop.

If you still see alerts, move to the next fix.

2. Outdated or Buggy Kernel-Mode Driver

When the alert says something about a driver (check Event Viewer – look for Event ID 4673 or 4674 with a source like Application Popup or Service Control Manager), you're probably dealing with an old driver that tries to access system memory it shouldn't. This is common with graphics card drivers from 2019 or earlier, especially Nvidia GeForce Game Ready drivers older than version 470, or Realtek audio drivers from 2020.

You can fix this by updating the driver. Here’s the direct way:

  1. Press Windows key + X and select Device Manager.
  2. Expand Display adapters (if it's a graphics driver) or Sound, video and game controllers (for audio).
  3. Right-click the device that's likely the problem – usually it's your main GPU or sound chip.
  4. Select Update driver.
  5. Choose Search automatically for drivers. Windows will check for a newer version.
  6. If Windows finds one, follow the prompts. After the update, restart your computer.

But here's the thing: Windows Update often misses the latest driver. Go to the manufacturer's website directly. For Nvidia, use GeForce Experience. For Realtek, grab the driver from your motherboard maker's site (like ASUS, Gigabyte, MSI). After updating, the privilege escalation block should vanish.

3. Malware or Suspicious Process Trying to Escalate Privileges

This is the scary one, but it's not as common as you think. When the alert is real malware, you'll see it happen over and over – maybe every few minutes. The process name in Event Viewer (look for Log Name: Security, Event ID 4673) will be something weird like svchost.exe running from a temp folder, or a random .exe in C:\Users\[YourName]\AppData\Local\Temp.

Here's what to do:

  1. Run a full scan with Windows Defender. Open Windows Security > Virus & threat protection > Scan options > Full scan. Click Scan now. This takes 30-60 minutes.
  2. While that runs, download Malwarebytes (free version is fine). Run a scan with it too. Malwarebytes catches things Defender sometimes misses.
  3. If both scans come back clean, go back to Event Viewer. Find the exact Process ID (PID) from the event. Open Task Manager (Ctrl+Shift+Esc), go to Details tab, and match the PID. If the process looks fishy – like it's named explorer.exe but it's not in C:\Windows – right-click it and choose End task.
  4. Then delete the file from its location. Be careful – only do this if you're 100% sure it's not a real Windows file.

After you remove the malware, restart your PC. The alerts should stop. If they don't, you might have a rootkit – that's when you should do a full Windows reinstall. I've seen it twice in ten years, so it's rare but possible.

Quick-Reference Summary Table

Cause What You See Fix
Misconfigured app Alert when opening a known app (like QuickBooks, TeamViewer) Set the app to "Run as administrator" in Compatibility tab
Old kernel driver Alert mentions a driver name (like nvlddmkm.sys or RTKVHD64.sys) Update the driver from Device Manager or manufacturer's site
Malware or suspicious process Frequent alerts, weird process name & location in Event Viewer Run full scans (Defender + Malwarebytes), kill suspicious process
Related Errors in Cybersecurity & Malware
0X800B010F CERT_E_CN_NO_MATCH (0X800B010F) Fix: 3 Steps Fix Windows Defender Blocked by Group Policy 0X800B0002 TRUST_E_ACTION_UNKNOWN (0X800B0002) Trust Provider Error Fix 0X00003618 IKE peer CRL check failed (0x00003618) – 3 fixes
privilege escalation attempt blocked Windows Event ID 4673 Windows Event ID 4674 privilege escalation blocked fix blocked privilege escalation security log privilege escalation Windows security alert admin privilege blocked system unauthorized privilege UAC bypass blocked malware privilege escalation Windows 10 privilege escalation fix Windows 11 privilege escalation fix server privilege escalation blocked group policy privilege escalation

Was this solution helpful?

EP
Erropedia Team
Tech Support Editors
The Erropedia editorial team researches and documents real-world tech errors from across Windows, Linux, macOS, networking, databases, cloud platforms, and more. Every solution is reviewed for accuracy and updated as software and systems evolve.