Event id windows таблица — Ваш верный помощник с OS Windows

Windows	1100	The event logging service has shut down
Windows	1101	Audit events have been dropped by the transport.
Windows	1102	The audit log was cleared
Windows	1104	The security Log is now full
Windows	1105	Event log automatic backup
Windows	1108	The event logging service encountered an error
Windows	4608	Windows is starting up
Windows	4609	Windows is shutting down
Windows	4610	An authentication package has been loaded by the Local Security Authority
Windows	4611	A trusted logon process has been registered with the Local Security Authority
Windows	4612	Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits.
Windows	4614	A notification package has been loaded by the Security Account Manager.
Windows	4615	Invalid use of LPC port
Windows	4616	The system time was changed.
Windows	4618	A monitored security event pattern has occurred
Windows	4621	Administrator recovered system from CrashOnAuditFail
Windows	4622	A security package has been loaded by the Local Security Authority.
Windows	4624	An account was successfully logged on
Windows	4625	An account failed to log on
Windows	4626	User/Device claims information
Windows	4627	Group membership information.
Windows	4634	An account was logged off
Windows	4646	IKE DoS-prevention mode started
Windows	4647	User initiated logoff
Windows	4648	A logon was attempted using explicit credentials
Windows	4649	A replay attack was detected
Windows	4650	An IPsec Main Mode security association was established
Windows	4651	An IPsec Main Mode security association was established
Windows	4652	An IPsec Main Mode negotiation failed
Windows	4653	An IPsec Main Mode negotiation failed
Windows	4654	An IPsec Quick Mode negotiation failed
Windows	4655	An IPsec Main Mode security association ended
Windows	4656	A handle to an object was requested
Windows	4657	A registry value was modified
Windows	4658	The handle to an object was closed
Windows	4659	A handle to an object was requested with intent to delete
Windows	4660	An object was deleted
Windows	4661	A handle to an object was requested
Windows	4662	An operation was performed on an object
Windows	4663	An attempt was made to access an object
Windows	4664	An attempt was made to create a hard link
Windows	4665	An attempt was made to create an application client context.
Windows	4666	An application attempted an operation
Windows	4667	An application client context was deleted
Windows	4668	An application was initialized
Windows	4670	Permissions on an object were changed
Windows	4671	An application attempted to access a blocked ordinal through the TBS
Windows	4672	Special privileges assigned to new logon
Windows	4673	A privileged service was called
Windows	4674	An operation was attempted on a privileged object
Windows	4675	SIDs were filtered
Windows	4688	A new process has been created
Windows	4689	A process has exited
Windows	4690	An attempt was made to duplicate a handle to an object
Windows	4691	Indirect access to an object was requested
Windows	4692	Backup of data protection master key was attempted
Windows	4693	Recovery of data protection master key was attempted
Windows	4694	Protection of auditable protected data was attempted
Windows	4695	Unprotection of auditable protected data was attempted
Windows	4696	A primary token was assigned to process
Windows	4697	A service was installed in the system
Windows	4698	A scheduled task was created
Windows	4699	A scheduled task was deleted
Windows	4700	A scheduled task was enabled
Windows	4701	A scheduled task was disabled
Windows	4702	A scheduled task was updated
Windows	4703	A token right was adjusted
Windows	4704	A user right was assigned
Windows	4705	A user right was removed
Windows	4706	A new trust was created to a domain
Windows	4707	A trust to a domain was removed
Windows	4709	IPsec Services was started
Windows	4710	IPsec Services was disabled
Windows	4711	PAStore Engine (1%)
Windows	4712	IPsec Services encountered a potentially serious failure
Windows	4713	Kerberos policy was changed
Windows	4714	Encrypted data recovery policy was changed
Windows	4715	The audit policy (SACL) on an object was changed
Windows	4716	Trusted domain information was modified
Windows	4717	System security access was granted to an account
Windows	4718	System security access was removed from an account
Windows	4719	System audit policy was changed
Windows	4720	A user account was created
Windows	4722	A user account was enabled
Windows	4723	An attempt was made to change an account’s password
Windows	4724	An attempt was made to reset an accounts password
Windows	4725	A user account was disabled
Windows	4726	A user account was deleted
Windows	4727	A security-enabled global group was created
Windows	4728	A member was added to a security-enabled global group
Windows	4729	A member was removed from a security-enabled global group
Windows	4730	A security-enabled global group was deleted
Windows	4731	A security-enabled local group was created
Windows	4732	A member was added to a security-enabled local group
Windows	4733	A member was removed from a security-enabled local group
Windows	4734	A security-enabled local group was deleted
Windows	4735	A security-enabled local group was changed
Windows	4737	A security-enabled global group was changed
Windows	4738	A user account was changed
Windows	4739	Domain Policy was changed
Windows	4740	A user account was locked out
Windows	4741	A computer account was created
Windows	4742	A computer account was changed
Windows	4743	A computer account was deleted
Windows	4744	A security-disabled local group was created
Windows	4745	A security-disabled local group was changed
Windows	4746	A member was added to a security-disabled local group
Windows	4747	A member was removed from a security-disabled local group
Windows	4748	A security-disabled local group was deleted
Windows	4749	A security-disabled global group was created
Windows	4750	A security-disabled global group was changed
Windows	4751	A member was added to a security-disabled global group
Windows	4752	A member was removed from a security-disabled global group
Windows	4753	A security-disabled global group was deleted
Windows	4754	A security-enabled universal group was created
Windows	4755	A security-enabled universal group was changed
Windows	4756	A member was added to a security-enabled universal group
Windows	4757	A member was removed from a security-enabled universal group
Windows	4758	A security-enabled universal group was deleted
Windows	4759	A security-disabled universal group was created
Windows	4760	A security-disabled universal group was changed
Windows	4761	A member was added to a security-disabled universal group
Windows	4762	A member was removed from a security-disabled universal group
Windows	4763	A security-disabled universal group was deleted
Windows	4764	A groups type was changed
Windows	4765	SID History was added to an account
Windows	4766	An attempt to add SID History to an account failed
Windows	4767	A user account was unlocked
Windows	4768	A Kerberos authentication ticket (TGT) was requested
Windows	4769	A Kerberos service ticket was requested
Windows	4770	A Kerberos service ticket was renewed
Windows	4771	Kerberos pre-authentication failed
Windows	4772	A Kerberos authentication ticket request failed
Windows	4773	A Kerberos service ticket request failed
Windows	4774	An account was mapped for logon
Windows	4775	An account could not be mapped for logon
Windows	4776	The domain controller attempted to validate the credentials for an account
Windows	4777	The domain controller failed to validate the credentials for an account
Windows	4778	A session was reconnected to a Window Station
Windows	4779	A session was disconnected from a Window Station
Windows	4780	The ACL was set on accounts which are members of administrators groups
Windows	4781	The name of an account was changed
Windows	4782	The password hash an account was accessed
Windows	4783	A basic application group was created
Windows	4784	A basic application group was changed
Windows	4785	A member was added to a basic application group
Windows	4786	A member was removed from a basic application group
Windows	4787	A non-member was added to a basic application group
Windows	4788	A non-member was removed from a basic application group..
Windows	4789	A basic application group was deleted
Windows	4790	An LDAP query group was created
Windows	4791	A basic application group was changed
Windows	4792	An LDAP query group was deleted
Windows	4793	The Password Policy Checking API was called
Windows	4794	An attempt was made to set the Directory Services Restore Mode administrator password
Windows	4797	An attempt was made to query the existence of a blank password for an account
Windows	4798	A user’s local group membership was enumerated.
Windows	4799	A security-enabled local group membership was enumerated
Windows	4800	The workstation was locked
Windows	4801	The workstation was unlocked
Windows	4802	The screen saver was invoked
Windows	4803	The screen saver was dismissed
Windows	4816	RPC detected an integrity violation while decrypting an incoming message
Windows	4817	Auditing settings on object were changed.
Windows	4818	Proposed Central Access Policy does not grant the same access permissions as the current Central Access Policy
Windows	4819	Central Access Policies on the machine have been changed
Windows	4820	A Kerberos Ticket-granting-ticket (TGT) was denied because the device does not meet the access control restrictions
Windows	4821	A Kerberos service ticket was denied because the user, device, or both does not meet the access control restrictions
Windows	4822	NTLM authentication failed because the account was a member of the Protected User group
Windows	4823	NTLM authentication failed because access control restrictions are required
Windows	4824	Kerberos preauthentication by using DES or RC4 failed because the account was a member of the Protected User group
Windows	4825	A user was denied the access to Remote Desktop. By default, users are allowed to connect only if they are members of the Remote Desktop Users group or Administrators group
Windows	4826	Boot Configuration Data loaded
Windows	4830	SID History was removed from an account
Windows	4864	A namespace collision was detected
Windows	4865	A trusted forest information entry was added
Windows	4866	A trusted forest information entry was removed
Windows	4867	A trusted forest information entry was modified
Windows	4868	The certificate manager denied a pending certificate request
Windows	4869	Certificate Services received a resubmitted certificate request
Windows	4870	Certificate Services revoked a certificate
Windows	4871	Certificate Services received a request to publish the certificate revocation list (CRL)
Windows	4872	Certificate Services published the certificate revocation list (CRL)
Windows	4873	A certificate request extension changed
Windows	4874	One or more certificate request attributes changed.
Windows	4875	Certificate Services received a request to shut down
Windows	4876	Certificate Services backup started
Windows	4877	Certificate Services backup completed
Windows	4878	Certificate Services restore started
Windows	4879	Certificate Services restore completed
Windows	4880	Certificate Services started
Windows	4881	Certificate Services stopped
Windows	4882	The security permissions for Certificate Services changed
Windows	4883	Certificate Services retrieved an archived key
Windows	4884	Certificate Services imported a certificate into its database
Windows	4885	The audit filter for Certificate Services changed
Windows	4886	Certificate Services received a certificate request
Windows	4887	Certificate Services approved a certificate request and issued a certificate
Windows	4888	Certificate Services denied a certificate request
Windows	4889	Certificate Services set the status of a certificate request to pending
Windows	4890	The certificate manager settings for Certificate Services changed.
Windows	4891	A configuration entry changed in Certificate Services
Windows	4892	A property of Certificate Services changed
Windows	4893	Certificate Services archived a key
Windows	4894	Certificate Services imported and archived a key
Windows	4895	Certificate Services published the CA certificate to Active Directory Domain Services
Windows	4896	One or more rows have been deleted from the certificate database
Windows	4897	Role separation enabled
Windows	4898	Certificate Services loaded a template
Windows	4899	A Certificate Services template was updated
Windows	4900	Certificate Services template security was updated
Windows	4902	The Per-user audit policy table was created
Windows	4904	An attempt was made to register a security event source
Windows	4905	An attempt was made to unregister a security event source
Windows	4906	The CrashOnAuditFail value has changed
Windows	4907	Auditing settings on object were changed
Windows	4908	Special Groups Logon table modified
Windows	4909	The local policy settings for the TBS were changed
Windows	4910	The group policy settings for the TBS were changed
Windows	4911	Resource attributes of the object were changed
Windows	4912	Per User Audit Policy was changed
Windows	4913	Central Access Policy on the object was changed
Windows	4928	An Active Directory replica source naming context was established
Windows	4929	An Active Directory replica source naming context was removed
Windows	4930	An Active Directory replica source naming context was modified
Windows	4931	An Active Directory replica destination naming context was modified
Windows	4932	Synchronization of a replica of an Active Directory naming context has begun
Windows	4933	Synchronization of a replica of an Active Directory naming context has ended
Windows	4934	Attributes of an Active Directory object were replicated
Windows	4935	Replication failure begins
Windows	4936	Replication failure ends
Windows	4937	A lingering object was removed from a replica
Windows	4944	The following policy was active when the Windows Firewall started
Windows	4945	A rule was listed when the Windows Firewall started
Windows	4946	A change has been made to Windows Firewall exception list. A rule was added
Windows	4947	A change has been made to Windows Firewall exception list. A rule was modified
Windows	4948	A change has been made to Windows Firewall exception list. A rule was deleted
Windows	4949	Windows Firewall settings were restored to the default values
Windows	4950	A Windows Firewall setting has changed
Windows	4951	A rule has been ignored because its major version number was not recognized by Windows Firewall
Windows	4952	Parts of a rule have been ignored because its minor version number was not recognized by Windows Firewall
Windows	4953	A rule has been ignored by Windows Firewall because it could not parse the rule
Windows	4954	Windows Firewall Group Policy settings has changed. The new settings have been applied
Windows	4956	Windows Firewall has changed the active profile
Windows	4957	Windows Firewall did not apply the following rule
Windows	4958	Windows Firewall did not apply the following rule because the rule referred to items not configured on this computer
Windows	4960	IPsec dropped an inbound packet that failed an integrity check
Windows	4961	IPsec dropped an inbound packet that failed a replay check
Windows	4962	IPsec dropped an inbound packet that failed a replay check
Windows	4963	IPsec dropped an inbound clear text packet that should have been secured
Windows	4964	Special groups have been assigned to a new logon
Windows	4965	IPsec received a packet from a remote computer with an incorrect Security Parameter Index (SPI).
Windows	4976	During Main Mode negotiation, IPsec received an invalid negotiation packet.
Windows	4977	During Quick Mode negotiation, IPsec received an invalid negotiation packet.
Windows	4978	During Extended Mode negotiation, IPsec received an invalid negotiation packet.
Windows	4979	IPsec Main Mode and Extended Mode security associations were established.
Windows	4980	IPsec Main Mode and Extended Mode security associations were established
Windows	4981	IPsec Main Mode and Extended Mode security associations were established
Windows	4982	IPsec Main Mode and Extended Mode security associations were established
Windows	4983	An IPsec Extended Mode negotiation failed
Windows	4984	An IPsec Extended Mode negotiation failed
Windows	4985	The state of a transaction has changed
Windows	5024	The Windows Firewall Service has started successfully
Windows	5025	The Windows Firewall Service has been stopped
Windows	5027	The Windows Firewall Service was unable to retrieve the security policy from the local storage
Windows	5028	The Windows Firewall Service was unable to parse the new security policy.
Windows	5029	The Windows Firewall Service failed to initialize the driver
Windows	5030	The Windows Firewall Service failed to start
Windows	5031	The Windows Firewall Service blocked an application from accepting incoming connections on the network.
Windows	5032	Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network
Windows	5033	The Windows Firewall Driver has started successfully
Windows	5034	The Windows Firewall Driver has been stopped
Windows	5035	The Windows Firewall Driver failed to start
Windows	5037	The Windows Firewall Driver detected critical runtime error. Terminating
Windows	5038	Code integrity determined that the image hash of a file is not valid
Windows	5039	A registry key was virtualized.
Windows	5040	A change has been made to IPsec settings. An Authentication Set was added.
Windows	5041	A change has been made to IPsec settings. An Authentication Set was modified
Windows	5042	A change has been made to IPsec settings. An Authentication Set was deleted
Windows	5043	A change has been made to IPsec settings. A Connection Security Rule was added
Windows	5044	A change has been made to IPsec settings. A Connection Security Rule was modified
Windows	5045	A change has been made to IPsec settings. A Connection Security Rule was deleted
Windows	5046	A change has been made to IPsec settings. A Crypto Set was added
Windows	5047	A change has been made to IPsec settings. A Crypto Set was modified
Windows	5048	A change has been made to IPsec settings. A Crypto Set was deleted
Windows	5049	An IPsec Security Association was deleted
Windows	5050	An attempt to programmatically disable the Windows Firewall using a call to INetFwProfile.FirewallEnabled(FALSE
Windows	5051	A file was virtualized
Windows	5056	A cryptographic self test was performed
Windows	5057	A cryptographic primitive operation failed
Windows	5058	Key file operation
Windows	5059	Key migration operation
Windows	5060	Verification operation failed
Windows	5061	Cryptographic operation
Windows	5062	A kernel-mode cryptographic self test was performed
Windows	5063	A cryptographic provider operation was attempted
Windows	5064	A cryptographic context operation was attempted
Windows	5065	A cryptographic context modification was attempted
Windows	5066	A cryptographic function operation was attempted
Windows	5067	A cryptographic function modification was attempted
Windows	5068	A cryptographic function provider operation was attempted
Windows	5069	A cryptographic function property operation was attempted
Windows	5070	A cryptographic function property operation was attempted
Windows	5071	Key access denied by Microsoft key distribution service
Windows	5120	OCSP Responder Service Started
Windows	5121	OCSP Responder Service Stopped
Windows	5122	A Configuration entry changed in the OCSP Responder Service
Windows	5123	A configuration entry changed in the OCSP Responder Service
Windows	5124	A security setting was updated on OCSP Responder Service
Windows	5125	A request was submitted to OCSP Responder Service
Windows	5126	Signing Certificate was automatically updated by the OCSP Responder Service
Windows	5127	The OCSP Revocation Provider successfully updated the revocation information
Windows	5136	A directory service object was modified
Windows	5137	A directory service object was created
Windows	5138	A directory service object was undeleted
Windows	5139	A directory service object was moved
Windows	5140	A network share object was accessed
Windows	5141	A directory service object was deleted
Windows	5142	A network share object was added.
Windows	5143	A network share object was modified
Windows	5144	A network share object was deleted.
Windows	5145	A network share object was checked to see whether client can be granted desired access
Windows	5146	The Windows Filtering Platform has blocked a packet
Windows	5147	A more restrictive Windows Filtering Platform filter has blocked a packet
Windows	5148	The Windows Filtering Platform has detected a DoS attack and entered a defensive mode; packets associated with this attack will be discarded.
Windows	5149	The DoS attack has subsided and normal processing is being resumed.
Windows	5150	The Windows Filtering Platform has blocked a packet.
Windows	5151	A more restrictive Windows Filtering Platform filter has blocked a packet.
Windows	5152	The Windows Filtering Platform blocked a packet
Windows	5153	A more restrictive Windows Filtering Platform filter has blocked a packet
Windows	5154	The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections
Windows	5155	The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections
Windows	5156	The Windows Filtering Platform has allowed a connection
Windows	5157	The Windows Filtering Platform has blocked a connection
Windows	5158	The Windows Filtering Platform has permitted a bind to a local port
Windows	5159	The Windows Filtering Platform has blocked a bind to a local port
Windows	5168	Spn check for SMB/SMB2 fails.
Windows	5169	A directory service object was modified
Windows	5170	A directory service object was modified during a background cleanup task
Windows	5376	Credential Manager credentials were backed up
Windows	5377	Credential Manager credentials were restored from a backup
Windows	5378	The requested credentials delegation was disallowed by policy
Windows	5379	Credential Manager credentials were read
Windows	5380	Vault Find Credential
Windows	5381	Vault credentials were read
Windows	5382	Vault credentials were read
Windows	5440	The following callout was present when the Windows Filtering Platform Base Filtering Engine started
Windows	5441	The following filter was present when the Windows Filtering Platform Base Filtering Engine started
Windows	5442	The following provider was present when the Windows Filtering Platform Base Filtering Engine started
Windows	5443	The following provider context was present when the Windows Filtering Platform Base Filtering Engine started
Windows	5444	The following sub-layer was present when the Windows Filtering Platform Base Filtering Engine started
Windows	5446	A Windows Filtering Platform callout has been changed
Windows	5447	A Windows Filtering Platform filter has been changed
Windows	5448	A Windows Filtering Platform provider has been changed
Windows	5449	A Windows Filtering Platform provider context has been changed
Windows	5450	A Windows Filtering Platform sub-layer has been changed
Windows	5451	An IPsec Quick Mode security association was established
Windows	5452	An IPsec Quick Mode security association ended
Windows	5453	An IPsec negotiation with a remote computer failed because the IKE and AuthIP IPsec Keying Modules (IKEEXT) service is not started
Windows	5456	PAStore Engine applied Active Directory storage IPsec policy on the computer
Windows	5457	PAStore Engine failed to apply Active Directory storage IPsec policy on the computer
Windows	5458	PAStore Engine applied locally cached copy of Active Directory storage IPsec policy on the computer
Windows	5459	PAStore Engine failed to apply locally cached copy of Active Directory storage IPsec policy on the computer
Windows	5460	PAStore Engine applied local registry storage IPsec policy on the computer
Windows	5461	PAStore Engine failed to apply local registry storage IPsec policy on the computer
Windows	5462	PAStore Engine failed to apply some rules of the active IPsec policy on the computer
Windows	5463	PAStore Engine polled for changes to the active IPsec policy and detected no changes
Windows	5464	PAStore Engine polled for changes to the active IPsec policy, detected changes, and applied them to IPsec Services
Windows	5465	PAStore Engine received a control for forced reloading of IPsec policy and processed the control successfully
Windows	5466	PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory cannot be reached, and will use the cached copy of the Active Directory IPsec policy instead
Windows	5467	PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, and found no changes to the policy
Windows	5468	PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, found changes to the policy, and applied those changes
Windows	5471	PAStore Engine loaded local storage IPsec policy on the computer
Windows	5472	PAStore Engine failed to load local storage IPsec policy on the computer
Windows	5473	PAStore Engine loaded directory storage IPsec policy on the computer
Windows	5474	PAStore Engine failed to load directory storage IPsec policy on the computer
Windows	5477	PAStore Engine failed to add quick mode filter
Windows	5478	IPsec Services has started successfully
Windows	5479	IPsec Services has been shut down successfully
Windows	5480	IPsec Services failed to get the complete list of network interfaces on the computer
Windows	5483	IPsec Services failed to initialize RPC server. IPsec Services could not be started
Windows	5484	IPsec Services has experienced a critical failure and has been shut down
Windows	5485	IPsec Services failed to process some IPsec filters on a plug-and-play event for network interfaces
Windows	5632	A request was made to authenticate to a wireless network
Windows	5633	A request was made to authenticate to a wired network
Windows	5712	A Remote Procedure Call (RPC) was attempted
Windows	5888	An object in the COM+ Catalog was modified
Windows	5889	An object was deleted from the COM+ Catalog
Windows	5890	An object was added to the COM+ Catalog
Windows	6144	Security policy in the group policy objects has been applied successfully
Windows	6145	One or more errors occured while processing security policy in the group policy objects
Windows	6272	Network Policy Server granted access to a user
Windows	6273	Network Policy Server denied access to a user
Windows	6274	Network Policy Server discarded the request for a user
Windows	6275	Network Policy Server discarded the accounting request for a user
Windows	6276	Network Policy Server quarantined a user
Windows	6277	Network Policy Server granted access to a user but put it on probation because the host did not meet the defined health policy
Windows	6278	Network Policy Server granted full access to a user because the host met the defined health policy
Windows	6279	Network Policy Server locked the user account due to repeated failed authentication attempts
Windows	6280	Network Policy Server unlocked the user account
Windows	6281	Code Integrity determined that the page hashes of an image file are not valid…
Windows	6400	BranchCache: Received an incorrectly formatted response while discovering availability of content.
Windows	6401	BranchCache: Received invalid data from a peer. Data discarded.
Windows	6402	BranchCache: The message to the hosted cache offering it data is incorrectly formatted.
Windows	6403	BranchCache: The hosted cache sent an incorrectly formatted response to the client’s message to offer it data.
Windows	6404	BranchCache: Hosted cache could not be authenticated using the provisioned SSL certificate.
Windows	6405	BranchCache: %2 instance(s) of event id %1 occurred.
Windows	6406	%1 registered to Windows Firewall to control filtering for the following:
Windows	6407	%1
Windows	6408	Registered product %1 failed and Windows Firewall is now controlling the filtering for %2.
Windows	6409	BranchCache: A service connection point object could not be parsed
Windows	6410	Code integrity determined that a file does not meet the security requirements to load into a process. This could be due to the use of shared sections or other issues
Windows	6416	A new external device was recognized by the system.
Windows	6417	The FIPS mode crypto selftests succeeded
Windows	6418	The FIPS mode crypto selftests failed
Windows	6419	A request was made to disable a device
Windows	6420	A device was disabled
Windows	6421	A request was made to enable a device
Windows	6422	A device was enabled
Windows	6423	The installation of this device is forbidden by system policy
Windows	6424	The installation of this device was allowed, after having previously been forbidden by policy
Windows	8191	Highest System-Defined Audit Message Value

Источник

Windows event ID 4608 — Windows is starting up

Windows event ID 4609 — Windows is shutting down

Windows event ID 4610 — An authentication package has been loaded by the Local Security Authority

Windows event ID 4611 — A trusted logon process has been registered with the Local Security Authority

Windows event ID 4612 — Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits

Windows event ID 4614 — A notification package has been loaded by the Security Account Manager

Windows event ID 4615 — Invalid use of LPC port

Windows event ID 4616 — The system time was changed

Windows event ID 4618 — A monitored security event pattern has occurred

Windows event ID 4621 — Administrator recovered system from CrashOnAuditFail. Users who are not administrators will now be allowed to log on. Some auditable activity might not have been recorded

Windows event ID 4622 — A security package has been loaded by the Local Security Authority

Windows event ID 4624 — An account was successfully logged on

Windows event ID 4625 — An account failed to log on

Windows event ID 4634 — An account was logged off

Windows event ID 4646 — IKE DoS-prevention mode started

Windows event ID 4647 — User initiated logoff

Windows event ID 4648 — A logon was attempted using explicit credentials

Windows event ID 4649 — A replay attack was detected

Windows event ID 4650 — An IPsec Main Mode security association was established

Windows event ID 4651 — An IPsec Main Mode security association was established

Windows event ID 4652 — An IPsec Main Mode negotiation failed

Windows event ID 4653 — An IPsec Main Mode negotiation failed

Windows event ID 4654 — An IPsec Quick Mode negotiation failed

Windows event ID 4655 — An IPsec Main Mode security association ended

Windows event ID 4656 — A handle to an object was requested

Windows event ID 4657 — A registry value was modified

Windows event ID 4658 — The handle to an object was closed

Windows event ID 4659 — A handle to an object was requested with intent to delete

Windows event ID 4660 — An object was deleted

Windows event ID 4661 — A handle to an object was requested

Windows event ID 4662 — An operation was performed on an object

Windows event ID 4663 — An attempt was made to access an object

Windows event ID 4664 — An attempt was made to create a hard link

Windows event ID 4665 — An attempt was made to create an application client context

Windows event ID 4666 — An application attempted an operation:

Windows event ID 4667 — An application client context was deleted

Windows event ID 4668 — An application was initialized

Windows event ID 4670 — Permissions on an object were changed

Windows event ID 4671 — An application attempted to access a blocked ordinal through the TBS

Windows event ID 4672 — Special privileges assigned to new logon

Windows event ID 4673 — A privileged service was called

Windows event ID 4674 — An operation was attempted on a privileged object

Windows event ID 4675 — SIDs were filtered

Windows event ID 4688 — A new process has been created

Windows event ID 4689 — A process has exited

Windows event ID 4690 — An attempt was made to duplicate a handle to an object

Windows event ID 4691 — Indirect access to an object was requested

Windows event ID 4692 — Backup of data protection master key was attempted

Windows event ID 4693 — Recovery of data protection master key was attempted

Windows event ID 4694 — Protection of auditable protected data was attempted

Windows event ID 4695 — Unprotection of auditable protected data was attempted

Windows event ID 4696 — A primary token was assigned to process

Windows event ID 4697 — A service was installed in the system

Windows event ID 4698 — A scheduled task was created

Windows event ID 4699 — A scheduled task was deleted

Windows event ID 4700 — A scheduled task was enabled

Windows event ID 4701 — A scheduled task was disabled

Windows event ID 4702 — A scheduled task was updated

Windows event ID 4704 — A user right was assigned

Windows event ID 4705 — A user right was removed

Windows event ID 4706 — A new trust was created to a domain

Windows event ID 4707 — A trust to a domain was removed

Windows event ID 4709 — IPsec Services was started

Windows event ID 4710 — IPsec Services was disabled

Windows event ID 4711 — PAStore Engine %1

Windows event ID 4712 — IPsec Services encountered a potentially serious failure

Windows event ID 4713 — Kerberos policy was changed

Windows event ID 4714 — Encrypted data recovery policy was changed

Windows event ID 4715 — The audit policy (SACL) on an object was changed

Windows event ID 4716 — Trusted domain information was modified

Windows event ID 4717 — System security access was granted to an account

Windows event ID 4718 — System security access was removed from an account

Windows event ID 4719 — System audit policy was changed

Windows event ID 4720 — A user account was created

Windows event ID 4722 — A user account was enabled

Windows event ID 4723 — An attempt was made to change an account’s password

Windows event ID 4724 — An attempt was made to reset an account’s password

Windows event ID 4725 — A user account was disabled

Windows event ID 4726 — A user account was deleted

Windows event ID 4727 — A security-enabled global group was created

Windows event ID 4728 — A member was added to a security-enabled global group

Windows event ID 4729 — A member was removed from a security-enabled global group

Windows event ID 4730 — A security-enabled global group was deleted

Windows event ID 4731 — A security-enabled local group was created

Windows event ID 4732 — A member was added to a security-enabled local group

Windows event ID 4733 — A member was removed from a security-enabled local group

Windows event ID 4734 — A security-enabled local group was deleted

Windows event ID 4735 — A security-enabled local group was changed

Windows event ID 4737 — A security-enabled global group was changed

Windows event ID 4738 — A user account was changed

Windows event ID 4739 — Domain Policy was changed

Windows event ID 4740 — A user account was locked out

Windows event ID 4741 — A computer account was created

Windows event ID 4742 — A computer account was changed

Windows event ID 4743 — A computer account was deleted

Windows event ID 4744 — A security-disabled local group was created

Windows event ID 4745 — A security-disabled local group was changed

Windows event ID 4746 — A member was added to a security-disabled local group

Windows event ID 4747 — A member was removed from a security-disabled local group

Windows event ID 4748 — A security-disabled local group was deleted

Windows event ID 4749 — A security-disabled global group was created

Windows event ID 4750 — A security-disabled global group was changed

Windows event ID 4751 — A member was added to a security-disabled global group

Windows event ID 4752 — A member was removed from a security-disabled global group

Windows event ID 4753 — A security-disabled global group was deleted

Windows event ID 4754 — A security-enabled universal group was created

Windows event ID 4755 — A security-enabled universal group was changed

Windows event ID 4756 — A member was added to a security-enabled universal group

Windows event ID 4757 — A member was removed from a security-enabled universal group

Windows event ID 4758 — A security-enabled universal group was deleted

Windows event ID 4759 — A security-disabled universal group was created

Windows event ID 4760 — A security-disabled universal group was changed

Windows event ID 4761 — A member was added to a security-disabled universal group

Windows event ID 4762 — A member was removed from a security-disabled universal group

Windows event ID 4763 — A security-disabled universal group was deleted

Windows event ID 4764 — A group’s type was changed

Windows event ID 4765 — SID History was added to an account

Windows event ID 4766 — An attempt to add SID History to an account failed

Windows event ID 4767 — A user account was unlocked

Windows event ID 4768 — A Kerberos authentication ticket (TGT) was requested

Windows event ID 4769 — A Kerberos service ticket was requested

Windows event ID 4770 — A Kerberos service ticket was renewed

Windows event ID 4771 — Kerberos pre-authentication failed

Windows event ID 4772 — A Kerberos authentication ticket request failed

Windows event ID 4773 — A Kerberos service ticket request failed

Windows event ID 4774 — An account was mapped for logon

Windows event ID 4775 — An account could not be mapped for logon

Windows event ID 4776 — The domain controller attempted to validate the credentials for an account

Windows event ID 4777 — The domain controller failed to validate the credentials for an account

Windows event ID 4778 — A session was reconnected to a Window Station

Windows event ID 4779 — A session was disconnected from a Window Station

Windows event ID 4780 — The ACL was set on accounts which are members of administrators groups

Windows event ID 4781 — The name of an account was changed:

Windows event ID 4782 — The password hash an account was accessed

Windows event ID 4783 — A basic application group was created

Windows event ID 4784 — A basic application group was changed

Windows event ID 4785 — A member was added to a basic application group

Windows event ID 4786 — A member was removed from a basic application group

Windows event ID 4787 — A non-member was added to a basic application group

Windows event ID 4788 — A non-member was removed from a basic application group

Windows event ID 4789 — A basic application group was deleted

Windows event ID 4790 — An LDAP query group was created

Windows event ID 4791 — A basic application group was changed

Windows event ID 4792 — An LDAP query group was deleted

Windows event ID 4793 — The Password Policy Checking API was called

Windows event ID 4794 — An attempt was made to set the Directory Services Restore Mode

Windows event ID 4800 — The workstation was locked

Windows event ID 4801 — The workstation was unlocked

Windows event ID 4802 — The screen saver was invoked

Windows event ID 4803 — The screen saver was dismissed

Windows event ID 4816 — RPC detected an integrity violation while decrypting an incoming message

Windows event ID 4817 — Auditing settings on an object were changed

Windows event ID 4864 — A namespace collision was detected

Windows event ID 4865 — A trusted forest information entry was added

Windows event ID 4866 — A trusted forest information entry was removed

Windows event ID 4867 — A trusted forest information entry was modified

Windows event ID 4868 — The certificate manager denied a pending certificate request

Windows event ID 4869 — Certificate Services received a resubmitted certificate request

Windows event ID 4870 — Certificate Services revoked a certificate

Windows event ID 4871 — Certificate Services received a request to publish the certificate revocation list (CRL)

Windows event ID 4872 — Certificate Services published the certificate revocation list (CRL)

Windows event ID 4873 — A certificate request extension changed

Windows event ID 4874 — One or more certificate request attributes changed

Windows event ID 4875 — Certificate Services received a request to shut down

Windows event ID 4876 — Certificate Services backup started

Windows event ID 4877 — Certificate Services backup completed

Windows event ID 4878 — Certificate Services restore started

Windows event ID 4879 — Certificate Services restore completed

Windows event ID 4880 — Certificate Services started

Windows event ID 4881 — Certificate Services stopped

Windows event ID 4882 — The security permissions for Certificate Services changed

Windows event ID 4883 — Certificate Services retrieved an archived key

Windows event ID 4884 — Certificate Services imported a certificate into its database

Windows event ID 4885 — The audit filter for Certificate Services changed

Windows event ID 4886 — Certificate Services received a certificate request

Windows event ID 4887 — Certificate Services approved a certificate request and issued a certificate

Windows event ID 4888 — Certificate Services denied a certificate request

Windows event ID 4889 — Certificate Services set the status of a certificate request to pending

Windows event ID 4890 — The certificate manager settings for Certificate Services changed

Windows event ID 4891 — A configuration entry changed in Certificate Services

Windows event ID 4892 — A property of Certificate Services changed

Windows event ID 4893 — Certificate Services archived a key

Windows event ID 4894 — Certificate Services imported and archived a key

Windows event ID 4895 — Certificate Services published the CA certificate to Active Directory Domain Services

Windows event ID 4896 — One or more rows have been deleted from the certificate database

Windows event ID 4897 — Role separation enabled:

Windows event ID 4898 — Certificate Services loaded a template

Windows event ID 4899 — A Certificate Services template was updated

Windows event ID 4900 — Certificate Services template security was updated

Windows event ID 4902 — The Per-user audit policy table was created

Windows event ID 4904 — An attempt was made to register a security event source

Windows event ID 4905 — An attempt was made to unregister a security event source

Windows event ID 4906 — The CrashOnAuditFail value has changed

Windows event ID 4907 — Auditing settings on object were changed

Windows event ID 4908 — Special Groups Logon table modified

Windows event ID 4909 — The local policy settings for the TBS were changed

Windows event ID 4910 — The group policy settings for the TBS were changed

Windows event ID 4912 — Per User Audit Policy was changed

Windows event ID 4928 — An Active Directory replica source naming context was established

Windows event ID 4929 — An Active Directory replica source naming context was removed

Windows event ID 4930 — An Active Directory replica source naming context was modified

Windows event ID 4931 — An Active Directory replica destination naming context was modified

Windows event ID 4932 — Synchronization of a replica of an Active Directory naming context has begun

Windows event ID 4933 — Synchronization of a replica of an Active Directory naming context has ended

Windows event ID 4934 — Attributes of an Active Directory object were replicated

Windows event ID 4935 — Replication failure begins

Windows event ID 4936 — Replication failure ends

Windows event ID 4937 — A lingering object was removed from a replica

Windows event ID 4944 — The following policy was active when the Windows Firewall started

Windows event ID 4945 — A rule was listed when the Windows Firewall started

Windows event ID 4946 — A change has been made to Windows Firewall exception list. A rule was added

Windows event ID 4947 — A change has been made to Windows Firewall exception list. A rule was modified

Windows event ID 4948 — A change has been made to Windows Firewall exception list. A rule was deleted

Windows event ID 4949 — Windows Firewall settings were restored to the default values

Windows event ID 4950 — A Windows Firewall setting has changed

Windows event ID 4951 — A rule has been ignored because its major version number was not recognized by Windows Firewall

Windows event ID 4952 — Parts of a rule have been ignored because its minor version number was not recognized by Windows Firewall. The other parts of the rule will be enforced

Windows event ID 4953 — A rule has been ignored by Windows Firewall because it could not parse the rule

Windows event ID 4954 — Windows Firewall Group Policy settings have changed. The new settings have been applied

Windows event ID 4956 — Windows Firewall has changed the active profile

Windows event ID 4957 — Windows Firewall did not apply the following rule:

Windows event ID 4958 — Windows Firewall did not apply the following rule because the rule referred to items not configured on this computer:

Windows event ID 4960 — IPsec dropped an inbound packet that failed an integrity check. If this problem persists, it could indicate a network issue or that packets are being modified in transit to this computer. Verify that the packets sent from the remot

Windows event ID 4961 — IPsec dropped an inbound packet that failed a replay check. If this problem persists, it could indicate a replay attack against this computer

Windows event ID 4962 — IPsec dropped an inbound packet that failed a replay check. The inbound packet had too low a sequence number to ensure it was not a replay

Windows event ID 4963 — IPsec dropped an inbound clear text packet that should have been secured. This is usually due to the remote computer changing its IPsec policy without informing this computer. This could also be a spoofing attack attempt

Windows event ID 4964 — Special groups have been assigned to a new logon

Windows event ID 4965 — IPsec received a packet from a remote computer with an incorrect Security Parameter Index (SPI). This is usually caused by malfunctioning hardware that is corrupting packets. If these errors persist, verify that the packets sent fr

Windows event ID 4976 — IPsec received an invalid negotiation packet

Windows event ID 4977 — IPsec received an invalid negotiation packet

Windows event ID 4978 — IPsec received an invalid negotiation packet

Windows event ID 4979 — IPsec Main Mode and Extended Mode security associations were established

Windows event ID 4980 — IPsec Main Mode and Extended Mode security associations were established

Windows event ID 4981 — IPsec Main Mode and Extended Mode security associations were established

Windows event ID 4982 — IPsec Main Mode and Extended Mode security associations were established

Windows event ID 4983 — An IPsec Extended Mode negotiation failed

Windows event ID 4984 — An IPsec Extended Mode negotiation failed

Windows event ID 4985 — The state of a transaction has changed

Windows event ID 5024 — The Windows Firewall Service has started successfully

Windows event ID 5025 — The Windows Firewall Service has been stopped

Windows event ID 5027 — The Windows Firewall Service was unable to retrieve the security policy from the local storage. The service will continue enforcing the current policy

Windows event ID 5028 — The Windows Firewall Service was unable to parse the new security policy. The service will continue with currently enforced policy

Windows event ID 5029 — The Windows Firewall Service failed to initialize the driver. The service will continue to enforce the current policy

Windows event ID 5030 — The Windows Firewall Service failed to start

Windows event ID 5031 — The Windows Firewall Service blocked an application from accepting incoming connections on the network

Windows event ID 5032 — Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network

Windows event ID 5033 — The Windows Firewall Driver has started successfully

Windows event ID 5034 — The Windows Firewall Driver has been stopped

Windows event ID 5035 — The Windows Firewall Driver failed to start

Windows event ID 5037 — The Windows Firewall Driver detected critical runtime error. Terminating

Windows event ID 5038 — Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error

Windows event ID 5039 — A registry key was virtualized

Windows event ID 5040 — IPsec: An Authentication Set was added

Windows event ID 5041 — IPsec: An Authentication Set was modified

Windows event ID 5042 — IPsec: An Authentication Set was deleted

Windows event ID 5043 — IPsec: A Connection Security Rule was added

Windows event ID 5044 — IPsec: A Connection Security Rule was modified

Windows event ID 5045 — IPsec: A Connection Security Rule was deleted

Windows event ID 5046 — IPsec: A Crypto Set was added

Windows event ID 5047 — IPsec: A Crypto Set was modified

Windows event ID 5048 — IPsec: A Crypto Set was deleted

Windows event ID 5049 — An IPsec Security Association was deleted

Windows event ID 5050 — An attempt to programmatically disable the Windows Firewall using a call to INetFwProfile.FirewallEnabled(FALSE) interface was rejected because this API is not supported on Windows Vista

Windows event ID 5051 — A file was virtualized

Windows event ID 5056 — A cryptographic self test was performed

Windows event ID 5057 — A cryptographic primitive operation failed

Windows event ID 5058 — Key file operation

Windows event ID 5059 — Key migration operation

Windows event ID 5060 — Verification operation failed

Windows event ID 5061 — Cryptographic operation

Windows event ID 5062 — A kernel-mode cryptographic self test was performed

Windows event ID 5063 — A cryptographic provider operation was attempted

Windows event ID 5064 — A cryptographic context operation was attempted

Windows event ID 5065 — A cryptographic context modification was attempted

Windows event ID 5066 — A cryptographic function operation was attempted

Windows event ID 5067 — A cryptographic function modification was attempted

Windows event ID 5068 — A cryptographic function provider operation was attempted

Windows event ID 5069 — A cryptographic function property operation was attempted

Windows event ID 5070 — A cryptographic function property modification was attempted

Windows event ID 5120 — OCSP Responder Service Started

Windows event ID 5121 — OCSP Responder Service Stopped

Windows event ID 5122 — A Configuration entry changed in the OCSP Responder Service

Windows event ID 5123 — A configuration entry changed in the OCSP Responder Service

Windows event ID 5124 — A security setting was updated on OCSP Responder Service

Windows event ID 5125 — A request was submitted to OCSP Responder Service

Windows event ID 5126 — Signing Certificate was automatically updated by the OCSP Responder Service

Windows event ID 5127 — The OCSP Revocation Provider successfully updated the revocation information

Windows event ID 5136 — A directory service object was modified

Windows event ID 5137 — A directory service object was created

Windows event ID 5138 — A directory service object was undeleted

Windows event ID 5139 — A directory service object was moved

Windows event ID 5140 — A network share object was accessed

Windows event ID 5141 — A directory service object was deleted

Windows event ID 5142 — A network share object was added

Windows event ID 5143 — A network share object was modified

Windows event ID 5144 — A network share object was deleted

Windows event ID 5145 — A network share object was checked to see whether the client can be granted desired access

Windows event ID 5148 — The Windows Filtering Platform has detected a DoS attack and entered a defensive mode; packets associated with this attack will be discarded

Windows event ID 5149 — The DoS attack has subsided and normal processing is being resumed

Windows event ID 5150 — The Windows Filtering Platform has blocked a packet

Windows event ID 5151 — A more restrictive Windows Filtering Platform filter has blocked a packet

Windows event ID 5152 — The Windows Filtering Platform blocked a packet

Windows event ID 5153 — A more restrictive Windows Filtering Platform filter has blocked a packet

Windows event ID 5154 — The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections

Windows event ID 5155 — The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections

Windows event ID 5156 — The Windows Filtering Platform has allowed a connection

Windows event ID 5157 — The Windows Filtering Platform has blocked a connection

Windows event ID 5158 — The Windows Filtering Platform has permitted a bind to a local port

Windows event ID 5159 — The Windows Filtering Platform has blocked a bind to a local port

Windows event ID 5168 — Spn check for SMB/SMB2 failed

Windows event ID 5376 — Credential Manager credentials were backed up

Windows event ID 5377 — Credential Manager credentials were restored from a backup

Windows event ID 5378 — The requested credentials delegation was disallowed by policy

Windows event ID 5440 — The following callout was present when the Windows Filtering Platform Base Filtering Engine started

Windows event ID 5441 — The following filter was present when the Windows Filtering Platform Base Filtering Engine started

Windows event ID 5442 — The following provider was present when the Windows Filtering Platform Base Filtering Engine started

Windows event ID 5443 — The following provider context was present when the Windows Filtering Platform Base Filtering Engine started

Windows event ID 5444 — The following sub-layer was present when the Windows Filtering Platform Base Filtering Engine started

Windows event ID 5446 — A Windows Filtering Platform callout has been changed

Windows event ID 5447 — A Windows Filtering Platform filter has been changed

Windows event ID 5448 — A Windows Filtering Platform provider has been changed

Windows event ID 5449 — A Windows Filtering Platform provider context has been changed

Windows event ID 5450 — A Windows Filtering Platform sub-layer has been changed

Windows event ID 5451 — An IPsec Quick Mode security association was established

Windows event ID 5452 — An IPsec Quick Mode security association ended

Windows event ID 5453 — An IPsec negotiation with a remote computer failed because the IKE and AuthIP IPsec Keying Modules (IKEEXT) service is not started

Windows event ID 5456 — PAStore Engine applied Active Directory storage IPsec policy on the computer

Windows event ID 5457 — PAStore Engine failed to apply Active Directory storage IPsec policy on the computer

Windows event ID 5458 — PAStore Engine applied locally cached copy of Active Directory storage IPsec policy on the computer

Windows event ID 5459 — PAStore Engine failed to apply locally cached copy of Active Directory storage IPsec policy on the computer

Windows event ID 5460 — PAStore Engine applied local registry storage IPsec policy on the computer

Windows event ID 5461 — PAStore Engine failed to apply local registry storage IPsec policy on the computer

Windows event ID 5462 — PAStore Engine failed to apply some rules of the active IPsec policy on the computer. Use the IP Security Monitor snap-in to diagnose the problem

Windows event ID 5463 — PAStore Engine polled for changes to the active IPsec policy and detected no changes

Windows event ID 5464 — PAStore Engine polled for changes to the active IPsec policy, detected changes, and applied them to IPsec Services

Windows event ID 5465 — PAStore Engine received a control for forced reloading of IPsec policy and processed the control successfully

Windows event ID 5466 — PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory cannot be reached, and will use the cached copy of the Active Directory IPsec policy instead. Any changes made to the Active D

Windows event ID 5467 — PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, and found no changes to the policy. The cached copy of the Active Directory IPsec policy is no longer being us

Windows event ID 5468 — PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, found changes to the policy, and applied those changes. The cached copy of the Active Directory IPsec policy i

Windows event ID 5471 — PAStore Engine loaded local storage IPsec policy on the computer

Windows event ID 5472 — PAStore Engine failed to load local storage IPsec policy on the computer

Windows event ID 5473 — PAStore Engine loaded directory storage IPsec policy on the computer

Windows event ID 5474 — PAStore Engine failed to load directory storage IPsec policy on the computer

Windows event ID 5477 — PAStore Engine failed to add quick mode filter

Windows event ID 5478 — IPsec Services has started successfully

Windows event ID 5479 — IPsec Services has been shut down successfully. The shutdown of IPsec Services can put the computer at greater risk of network attack or expose the computer to potential security risks

Windows event ID 5480 — IPsec Services failed to get the complete list of network interfaces on the computer. This poses a potential security risk because some of the network interfaces may not get the protection provided by the applied IPsec filters. Use

Windows event ID 5483 — IPsec Services failed to initialize RPC server. IPsec Services could not be started

Windows event ID 5484 — IPsec Services has experienced a critical failure and has been shut down. The shutdown of IPsec Services can put the computer at greater risk of network attack or expose the computer to potential security risks

Windows event ID 5485 — IPsec Services failed to process some IPsec filters on a plug-and-play event for network interfaces. This poses a potential security risk because some of the network interfaces may not get the protection provided by the applied IPs

Windows event ID 5632 — A request was made to authenticate to a wireless network

Windows event ID 5633 — A request was made to authenticate to a wired network

Windows event ID 5712 — A Remote Procedure Call (RPC) was attempted

Windows event ID 5888 — An object in the COM+ Catalog was modified

Windows event ID 5889 — An object was deleted from the COM+ Catalog

Windows event ID 5890 — An object was added to the COM+ Catalog

Windows event ID 6144 — Security policy in the group policy objects has been applied successfully

Windows event ID 6145 — One or more errors occurred while processing security policy in the group policy objects

Windows event ID 6272 — Network Policy Server granted access to a user

Windows event ID 6273 — Network Policy Server denied access to a user

Windows event ID 6274 — Network Policy Server discarded the request for a user

Windows event ID 6275 — Network Policy Server discarded the accounting request for a user

Windows event ID 6276 — Network Policy Server quarantined a user

Windows event ID 6277 — Network Policy Server granted access to a user but put it on probation because the host did not meet the defined health policy

Windows event ID 6278 — Network Policy Server granted full access to a user because the host met the defined health policy

Windows event ID 6279 — Network Policy Server locked the user account due to repeated failed authentication attempts

Windows event ID 6280 — Network Policy Server unlocked the user account

Windows event ID 6281 — Code Integrity determined that the page hashes of an image file are not valid. The file could be improperly signed without page hashes or corrupt due to unauthorized modification. The invalid hashes could indicate a potential disk

Windows event ID 6400 — BranchCache: Received an incorrectly formatted response while discovering availability of content.

Windows event ID 6401 — BranchCache: Received invalid data from a peer. Data discarded.

Windows event ID 6402 — BranchCache: The message to the hosted cache offering it data is incorrectly formatted.

Windows event ID 6403 — BranchCache: The hosted cache sent an incorrectly formatted response to the client

Windows event ID 6404 — BranchCache: Hosted cache could not be authenticated using the provisioned SSL certificate.

Windows event ID 6405 — BranchCache: %2 instance(s) of event id %1 occurred

Windows event ID 6406 — %1 registered to Windows Firewall to control filtering for the following: %2

Windows event ID 6407 — 1%

Windows event ID 6408 — Registered product %1 failed and Windows Firewall is now controlling the filtering for %2

Windows event ID 8191 — Highest System-Defined Audit Message Value

Источник

Windows Event IDs and Others for Situational Awareness

Below is a living list of Windows event IDs and other miscellaenous snippets, that may be useful for situational awareness, once you are on a box:

Powershell to read event logs for the

Get-WinEvent -FilterHashtable @{ LogName=’security’; Id=’4800′ }

Get-WinEvent -FilterHashtable @{ LogName=’security’; Id=’4801′ }

Get-WinEvent -FilterHashtable @{ LogName=’security’; Id=’4802′ }

Get-WinEvent -FilterHashtable @{ LogName=’security’; Id=’4803′ }

Get-WinEvent -FilterHashtable @{ LogName=’security’; Id=’4608′ }

Get-WinEvent -FilterHashtable @{ LogName=’system’; Id=’6013′ }

Get-WinEvent -FilterHashtable @{ LogName=’security’; Id=’4609′ }

System has been shut down

Get-WinEvent -FilterHashtable @{ LogName=’system’; Id=’1074′ }

System entering sleep mode

Get-WinEvent -FilterHashtable @{ LogName=’system’; Id=42 }

System returning from sleep

Get-WinEvent -FilterHashtable @{ LogName=’system’; Id=’1′; ProviderName = «Microsoft-Windows-Power-Troubleshooter» }

Get-WinEvent -FilterHashtable @{ LogName=’Security’; Id=’4624′ }

Logons with explicit credentials

Get-WinEvent -FilterHashtable @{ LogName=’Security’; Id=’4648′ }

Get-WinEvent -FilterHashtable @{ LogName=’security’; Id=’4634′ }

Get-WinEvent -FilterHashtable @{ LogName=’Microsoft-Windows-TerminalServices-RDPClient/Operational’; id=’1024′ } | select timecreated, message | ft -AutoSize -Wrap

Get-WinEvent -FilterHashtable @{ LogName=’Microsoft-Windows-TerminalServices-LocalSessionManager/Operational’; id=’21’ } | select timecreated, message | ft -AutoSize -Wrap

Get-WinEvent -FilterHashtable @{ LogName=’Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational’; id=131 } | select timecreated, message | ft -AutoSize -Wrap

Get-WinEvent -FilterHashtable @{ LogName=’Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational’; id=’1149′ } | ft -AutoSize -Wrap

Get-WinEvent -FilterHashtable @{ LogName=’Microsoft-Windows-WinRM/Operational’; id=6 }

Get-WinEvent -FilterHashtable @{ LogName=’Microsoft-Windows-WinRM/Operational’; id=80 }

Get-WinEvent -FilterHashtable @{ LogName=’Microsoft-Windows-WinRM/Operational’; id=91 }

Get-WinEvent -FilterHashtable @{ LogName=’Microsoft-Windows-WMI-Activity/Operational’; id=5857 } | ? {$_.message -match ‘Win32_WIN32_TERMINALSERVICE_Prov|CIMWin32’}

Inbound Network and Interactive Logons

$events = New-Object System.Collections.ArrayList

Get-WinEvent -FilterHashtable @{ LogName=’Security’; id=(4624); starttime=(get-date).AddMinutes(-60*24*2) } | % {

$event = New-Object psobject

$subjectUser = $_.properties[2].value + «\» + $_.properties[1].value

$targetUser = $_.properties[6].value + «\» + $_.properties[5].value

$logonType = $_.properties[8].value

$subjectComputer = $_.properties[18].value

if ($logonType -in 3,7,8,9,10,11 -and $subjectComputer -notmatch «::1|-|^127.0.0.1»)

{

switch ($logonType) {

3 { $logonType = «Network» }

7 { $logonType = «Screen Unlock» }

8 { $logonType = «Network Cleartext» }

9 { $logonType = «New Credentials» }

10 { $logonType = «Remote Interactive» }

11 { $logonType = «Cached Interactive» }

}

$event | Add-Member «Time» $_.TimeCreated

$event | Add-Member «Subject» $subjectUser

$event | Add-Member «LogonFrom» $subjectComputer

$event | Add-Member «LoggedAs» $targetUser

$event | Add-Member «Type» $logonType

$events.Add($event) | out-null

}

$events

$events = New-Object System.Collections.ArrayList

Get-WinEvent -FilterHashtable @{ LogName=’Security’; id=(4648); starttime=(get-date).AddMinutes(-60*24*2) } | % {

$event = New-Object psobject

$subjecUser = $_.Properties[2].Value + «\» + $_.Properties[1].Value

$targetUser = $_.Properties[6].Value + «\» + $_.Properties[5].Value

$targetInfo = $_.Properties[9].Value

$process = $_.Properties[11].Value

$event | Add-Member «Time» $_.timecreated

$event | Add-Member «SubjectUser» $subjecUser

$event | Add-Member «TargetUser» $targetUser

$event | Add-Member «Target» $targetInfo

$event | Add-Member «Process» $process

if ($targetInfo -notmatch ‘localhost’)

{

$events.add($event) | out-null

}

$events

Attempt to install a service

Get-WinEvent -FilterHashtable @{ LogName=’Security’; Id=’4697′ }

Get-WinEvent -FilterHashtable @{ LogName=’security’; Id=’4698′ }

Get-WinEvent -FilterHashtable @{ LogName=’security’; Id=’4702′ }

Get-ItemProperty ‘HKCU:\SOFTWARE\Sysinternals\*’ | select PSChildName, EulaAccepted

LSASS started as a protected process

Get-WinEvent -FilterHashtable @{ LogName=’system’; Id=’12’ ; ProviderName=’Microsoft-Windows-Wininit’ }

Источник

Время на прочтение4 мин

Количество просмотров309K

Рэнди Франклин Смит (CISA, SSCP, Security MVP) имеет в своем арсенале очень полезный документ, рассказывающий о том, какие события (event IDs) обязательно должны отслеживаться в рамках обеспечения информационной безопасности Windows. В этом документе изложена крайне полезная информация, которая позволит Вам “выжать” максимум из штатной системы аудита. Мы подготовили перевод этого материала. Заинтересованных приглашаем под кат.

О том, как настроить аудит, мы уже обстоятельно писали в одном из наших постов. Но из всех event id, которые встречаются в журналах событий, необходимо остановить свое внимание на нескольких критических важных. На каких именно – решать каждому. Однако Рэнди Франклин Смит предлагает сосредоточить внимание на 10 важных событиях безопасности в Windows.

Контроллеры доменов

Event ID — (Категория) — Описание

1) 675 или 4771
(Аудит событий входа в систему)
Событие 675/4771 на контроллере домена указывает на неудачную попытку войти через Kerberos на рабочей станции с доменной учетной записью. Обычно причиной этого является несоответствующий пароль, но код ошибки указывает, почему именно аутентификация была неудачной. Таблица кодов ошибок Kerberos приведена ниже.

2) 676, или Failed 672 или 4768
(Аудит событий входа в систему)
Событие 676/4768 логгируется для других типов неудачной аутентификации. Таблица кодов Kerberos приведена ниже.
ВНИМАНИЕ: В Windows 2003 Server событие отказа записывается как 672 вместо 676.

3) 681 или Failed 680 или 4776
(Аудит событий входа в систему)
Событие 681/4776 на контроллере домена указывает на неудачную попытку входа в систему через
NTLM с доменной учетной записью. Код ошибки указывает, почему именно аутентификация была неудачной.
Коды ошибок NTLM приведены ниже.
ВНИМАНИЕ: В Windows 2003 Server событие отказа записывается как 680 вместо 681.

4) 642 или 4738
(Аудит управления учетными записями)
Событие 642/4738 указывает на изменения в указанной учетной записи, такие как сброс пароля или активация деактивированной до этого учетной записи. Описание события уточняется в соответствие с типом изменения.

5) 632 или 4728; 636 или 4732; 660 или 4756
(Аудит управления учетными записями)
Все три события указывают на то, что указанный пользователь был добавлен в определенную группу. Обозначены Глобальная (Global), Локальная (Local) и Общая (Universal) соответственно для каждого ID.

6) 624 или 4720
(Аудит управления учетными записями)
Была создана новая учетная запись пользователя

7) 644 или 4740
(Аудит управления учетными записями)
Учетная запись указанного пользователя была заблокирована после нескольких попыток входа

517 или 1102
(Аудит системных событий)
Указанный пользователь очистил журнал безопасности

Вход и выход из системы (Logon/Logoff)

Event Id — Описание

528 или 4624 — Успешный вход в систему
529 или 4625 — Отказ входа в систему – Неизвестное имя пользователя или неверный пароль
530 или 4625 Отказ входа в систему – Вход в систему не был осуществлен в течение обозначенного периода времени
531 или 4625 — Отказ входа в систему – Учетная запись временно деактивирована
532 или 4625 — Отказ входа в систему – Срок использования указанной учетной записи истек
533 или 4625 — Отказ входа в систему – Пользователю не разрешается осуществлять вход в систему на данном компьютере
534 или 4625 или 5461 — Отказ входа в систему – Пользователь не был разрешен запрашиваемый тип входа на данном компьютере
535 или 4625 — Отказ входа в систему – Срок действия пароля указанной учетной записи истек
539 или 4625 — Отказ входа в систему – Учетная запись заблокирована
540 или 4624 — Успешный сетевой вход в систему (Только Windows 2000, XP, 2003)

Типы входов в систему (Logon Types)

Тип входа в систему — Описание

2 — Интерактивный (вход с клавиатуры или экрана системы)
3 — Сетевой (например, подключение к общей папке на этом компьютере из любого места в сети или IIS вход — Никогда не заходил 528 на Windows Server 2000 и выше. См. событие 540)
4 — Пакет (batch) (например, запланированная задача)
5 — Служба (Запуск службы)
7 — Разблокировка (например, необслуживаемая рабочая станция с защищенным паролем скринсейвером)
8 — NetworkCleartext (Вход с полномочиями (credentials), отправленными в виде простого текст. Часто обозначает вход в IIS с “базовой аутентификацией”)
9 — NewCredentials
10 — RemoteInteractive (Терминальные службы, Удаленный рабочий стол или удаленный помощник)
11 — CachedInteractive (вход с кешированными доменными полномочиями, например, вход на рабочую станцию, которая находится не в сети)

Коды отказов Kerberos

Код ошибки — Причина

6 — Имя пользователя не существует
12 — Ограничение рабочей машины; ограничение времени входа в систему
18 — Учетная запись деактивирована, заблокирована или истек срок ее действия
23 — Истек срок действия пароля пользователя
24 — Предварительная аутентификация не удалась; обычно причиной является неверный пароль
32 — Истек срок действия заявки. Это нормальное событие, которое логгируется учетными записями компьютеров
37 — Время на рабочей машины давно не синхронизировалось со временем на контроллере домена

Коды ошибок NTLM

Код ошибки (десятичная система) — Код ошибки (16-ричная система) — Описание

3221225572 — C0000064 — Такого имени пользователя не существует
3221225578 — C000006A — Верное имя пользователя, но неверный пароль
3221226036 — C0000234 — Учетная запись пользователя заблокирована
3221225586 — C0000072 — Учетная запись деактивирована
3221225583 — C000006F — Пользователь пытается войти в систему вне обозначенного периода времени (рабочего времени)
3221225584 — C0000070 — Ограничение рабочей станции
3221225875 — C0000193 — Истек срок действия учетной записи
3221225585 — C0000071 — Истек срок действия пароля
3221226020 — C0000224 — Пользователь должен поменять пароль при следующем входе в систему

Еще раз продублируем ссылку на скачивание документа на сайте Рэнди Франклина Смита www.ultimatewindowssecurity.com/securitylog/quickref/Default.aspx. Нужно будет заполнить небольшую форму, чтобы получить к нему доступ.

P.S. Хотите полностью автоматизировать работу с журналами событий? Попробуйте новую версию NetWrix Event Log Manager 4.0, которая осуществляет сбор и архивирование журналов событий, строит отчеты и генерирует оповещения в режиме реального времени. Программа собирает данные с многочисленных компьютеров сети, предупреждает Вас о критических событиях и централизованно хранит данные обо всех событиях в сжатом формате для удобства анализа архивных данных журналов. Доступна бесплатная версия программы для 10 контроллеров доменов и 100 компьютеров.

Источник

This article serves as a quick reference for Windows Security Log event IDs.

Windows Security Log Reference

To Open the security log run

Then in the console tree, expand Windows Logs, and then click Security. The results pane lists individual security events.

User Account Changes

Event ID	Description
4720	Created
4722	Enabled
4723	User changed own password
4724	Privileged User changed this user’s password
4725	Disabled
4726	Deleted
4738	Changed
4740	Locked out
4767	Unlocked
4781	Name change

Domain Controller Authentication Events

Event ID	Description
4768	A Kerberos authentication ticket (TGT) was requested
4771	Kerberos pre-authentication failed
4820	A Kerberos TGT was denied because the device does not meet the access control restrictions

Logon Session Events (Correlate by Logon ID)

Event ID	Description
4624	Successful logon
4647	User initiated logoff
4625	Logon failure {See Logon Failure Codes)
4778	Remote desktop session reconnected
4779	Remote desktop session disconnected
4800	Workstation locked
4801	Workstation unlocked
4802	Screen saver invoked
4803	Screen saver dismissed

Logon Types

Type ID	Description
2	Interactive
3	Network (i.e. mapped drive)
4	Batch
5	Service (service startup)
7	Unlock
8	Network Cleartext
10	Remote Desktop
11	Logon with cached credentials

Security Group Changes

Action	Local	Global	Universal
Created	4731	4727	4754
Changed	4735	4737	4755
Deleted	4734	4730	4758
Member Added	4732	4728	4756
Member Removed	4733	4729	4757

Distribution Group Changes

Action	Local	Global	Universal
Created	4744	4749	4759
Changed	4745	4750	4760
Deleted	4748	4753	4763
Member Added	4746	4751	4761
Member Removed	4747	4752	4762

Источник