Windows-Log-Analysis
Event code cheatsheet
Windows log event codes and sysmon codes to monitor for early detection of anomalous and suspicious behavior warranting further investigation (includes
all pertinent Windows log types)
Some of these event codes are noisy, so be sure to filter normal events in your SIEM environment to narrow search for outliers
Event codes 0-999
18 Windows Update activity ready
19 Windows Update activity installed
20 Windows Update activity failure
40 Issue with Driver
104 System log cleared (covering tracks)
106 New scheduled job (persistence through scheduled task)
129 Created task
141 Deleted task
400 Kernel PNP events, Powershell
401 Failed OWA login (Email/VPN)
410 Kernel PNP configuration
500 Powershell logs (PS4)
501 Powershell log
528 Account log in (Account crawling)
540 Account log in (Account crawling)
567 Operation performed on object (files or registry keys added)
592 New Process created (potential malicious process, malware initiation)
600 Powershell logs (PS4)
601 New service install
800 Powershell logs (PS4)
866 Access to filename restricted
Event codes 1000-1999
1000 Application error/crash
1001 DNS operational log, DNS settings (potential for MITM attack)
1007 Installation of filename not permitted
1022 Windows Installer activity updated
1033 Windows Installer activity installed
1034 Windows Installer activity removed
1102 Audit log cleared (covering tracks)
Event codes 2000-2999
2004 Windows Firewall rule added (firewall evasion)
2005 Windows Firewall rule modified (firewall evasion)
2006 Windows Firewall rule deleted (firewall evasion)
Event codes 3000-3999
3008 DNS requests/queries
3010 DNS requests/queries
Event codes 4000-4999
4100 Powershell log (PS5 and newer)
4103 Powershell log (PS5 and newer)
4104 Powershell log (PS5 and newer)
4624 Account log in (Account crawling)
4625 Failed accountt log on
4648 Logon attempt with explicit credentials
4656 Object handle accessed
4657 Registry value modified
4662 Operation performed on object (object with SACL)
4663 Operation performed on object (files or registry keys added)
4672 Special privileges assigned to new logon
4673 Special privileges (credential harvesting/Mimikatz)
4688 New Process (malicious process, malware initiation)
4697 Service installed
4698 New Task Created
4702 Task modified
4703 Token right modified
4719 System audit policy was changed (non SYSTEM changes to audit policy)
4720 User acct created (password attacks)
4724 Reset password attempt (password attacks)
4732 Account added to local admin group (Persistence, defense evasion)
4735 Local group changed (password attacks)
4738 User account password changed (password attacks)
4769 Kerberos ticket request, failed attempts (Kerberos spraying, Kerberoasting)
4771 Kerberos pre-authentication failed (Kerberos spraying, Kerberoasting)
Event codes 5000-5999
5140 Network share object accessed (Lateral movement on endpoints)
5145 Network share object accessed (Lateral movement on endpoints)
5152 Packet blocked
5154 Allowed an application to listen for incoming connections
5156 Windows Firewall allowed connection (malicious processes, failed port scans)
5157 Connection blocked
Event codes 6000-6999
6009 Lists OS versions
6281 Failed/bad hash (images with bad hashes)
Event codes 7000-7999
7009 Timeout waiting for service to connect (possibly malicious code masquerading as a service)
7040 Service Change of State
7045 New Service Install
Event codes 8000-8999
8004 Filename not allowed to run
8000-8027 Applocker events
Event codes 9000+
11707 Software installation successful (addition of unauthorized apps/programs)
11724 Software package removed (removal of required apps/programs)
Event codes used in ransomware/malware attacks
4688/592 New Process (Malware dropper, initial installation)
7045/601 New Service Install (Service added to endpoint)
4624/528/540 Account log in
4663/567 File & registry auditing (Files or registry new keys added, CryptoWare and malware drops)
5156 Windows Firewall Network allowed connection by process
7040 Service Change of State
5140/560 Share accessed (crawling shares on different systems)
4657 Registry value modified
4698 New Task Created
4769/4771 Kerberos failed attempts (Kerberos spraying, Kerberoasting)
Sysmon event codes for more granular investigation
1 Provides hash of the process/file (4688) (identify known malicious hash)
3 Provides some name resolution of IP (5156)
7 Image Loaded (unsigned malware)
15 File create stream hash
17 Pipe event created
18 Pipe event connected
22 Provides process that made DNS query
255 Sysmon error
Время на прочтение4 мин
Количество просмотров309K
Рэнди Франклин Смит (CISA, SSCP, Security MVP) имеет в своем арсенале очень полезный документ, рассказывающий о том, какие события (event IDs) обязательно должны отслеживаться в рамках обеспечения информационной безопасности Windows. В этом документе изложена крайне полезная информация, которая позволит Вам “выжать” максимум из штатной системы аудита. Мы подготовили перевод этого материала. Заинтересованных приглашаем под кат.
О том, как настроить аудит, мы уже обстоятельно писали в одном из наших постов. Но из всех event id, которые встречаются в журналах событий, необходимо остановить свое внимание на нескольких критических важных. На каких именно – решать каждому. Однако Рэнди Франклин Смит предлагает сосредоточить внимание на 10 важных событиях безопасности в Windows.
Контроллеры доменов
Event ID — (Категория) — Описание
1) 675 или 4771
(Аудит событий входа в систему)
Событие 675/4771 на контроллере домена указывает на неудачную попытку войти через Kerberos на рабочей станции с доменной учетной записью. Обычно причиной этого является несоответствующий пароль, но код ошибки указывает, почему именно аутентификация была неудачной. Таблица кодов ошибок Kerberos приведена ниже.
2) 676, или Failed 672 или 4768
(Аудит событий входа в систему)
Событие 676/4768 логгируется для других типов неудачной аутентификации. Таблица кодов Kerberos приведена ниже.
ВНИМАНИЕ: В Windows 2003 Server событие отказа записывается как 672 вместо 676.
3) 681 или Failed 680 или 4776
(Аудит событий входа в систему)
Событие 681/4776 на контроллере домена указывает на неудачную попытку входа в систему через
NTLM с доменной учетной записью. Код ошибки указывает, почему именно аутентификация была неудачной.
Коды ошибок NTLM приведены ниже.
ВНИМАНИЕ: В Windows 2003 Server событие отказа записывается как 680 вместо 681.
4) 642 или 4738
(Аудит управления учетными записями)
Событие 642/4738 указывает на изменения в указанной учетной записи, такие как сброс пароля или активация деактивированной до этого учетной записи. Описание события уточняется в соответствие с типом изменения.
5) 632 или 4728; 636 или 4732; 660 или 4756
(Аудит управления учетными записями)
Все три события указывают на то, что указанный пользователь был добавлен в определенную группу. Обозначены Глобальная (Global), Локальная (Local) и Общая (Universal) соответственно для каждого ID.
6) 624 или 4720
(Аудит управления учетными записями)
Была создана новая учетная запись пользователя
7) 644 или 4740
(Аудит управления учетными записями)
Учетная запись указанного пользователя была заблокирована после нескольких попыток входа
517 или 1102
(Аудит системных событий)
Указанный пользователь очистил журнал безопасности
Вход и выход из системы (Logon/Logoff)
Event Id — Описание
528 или 4624 — Успешный вход в систему
529 или 4625 — Отказ входа в систему – Неизвестное имя пользователя или неверный пароль
530 или 4625 Отказ входа в систему – Вход в систему не был осуществлен в течение обозначенного периода времени
531 или 4625 — Отказ входа в систему – Учетная запись временно деактивирована
532 или 4625 — Отказ входа в систему – Срок использования указанной учетной записи истек
533 или 4625 — Отказ входа в систему – Пользователю не разрешается осуществлять вход в систему на данном компьютере
534 или 4625 или 5461 — Отказ входа в систему – Пользователь не был разрешен запрашиваемый тип входа на данном компьютере
535 или 4625 — Отказ входа в систему – Срок действия пароля указанной учетной записи истек
539 или 4625 — Отказ входа в систему – Учетная запись заблокирована
540 или 4624 — Успешный сетевой вход в систему (Только Windows 2000, XP, 2003)
Типы входов в систему (Logon Types)
Тип входа в систему — Описание
2 — Интерактивный (вход с клавиатуры или экрана системы)
3 — Сетевой (например, подключение к общей папке на этом компьютере из любого места в сети или IIS вход — Никогда не заходил 528 на Windows Server 2000 и выше. См. событие 540)
4 — Пакет (batch) (например, запланированная задача)
5 — Служба (Запуск службы)
7 — Разблокировка (например, необслуживаемая рабочая станция с защищенным паролем скринсейвером)
8 — NetworkCleartext (Вход с полномочиями (credentials), отправленными в виде простого текст. Часто обозначает вход в IIS с “базовой аутентификацией”)
9 — NewCredentials
10 — RemoteInteractive (Терминальные службы, Удаленный рабочий стол или удаленный помощник)
11 — CachedInteractive (вход с кешированными доменными полномочиями, например, вход на рабочую станцию, которая находится не в сети)
Коды отказов Kerberos
Код ошибки — Причина
6 — Имя пользователя не существует
12 — Ограничение рабочей машины; ограничение времени входа в систему
18 — Учетная запись деактивирована, заблокирована или истек срок ее действия
23 — Истек срок действия пароля пользователя
24 — Предварительная аутентификация не удалась; обычно причиной является неверный пароль
32 — Истек срок действия заявки. Это нормальное событие, которое логгируется учетными записями компьютеров
37 — Время на рабочей машины давно не синхронизировалось со временем на контроллере домена
Коды ошибок NTLM
Код ошибки (десятичная система) — Код ошибки (16-ричная система) — Описание
3221225572 — C0000064 — Такого имени пользователя не существует
3221225578 — C000006A — Верное имя пользователя, но неверный пароль
3221226036 — C0000234 — Учетная запись пользователя заблокирована
3221225586 — C0000072 — Учетная запись деактивирована
3221225583 — C000006F — Пользователь пытается войти в систему вне обозначенного периода времени (рабочего времени)
3221225584 — C0000070 — Ограничение рабочей станции
3221225875 — C0000193 — Истек срок действия учетной записи
3221225585 — C0000071 — Истек срок действия пароля
3221226020 — C0000224 — Пользователь должен поменять пароль при следующем входе в систему
Еще раз продублируем ссылку на скачивание документа на сайте Рэнди Франклина Смита www.ultimatewindowssecurity.com/securitylog/quickref/Default.aspx. Нужно будет заполнить небольшую форму, чтобы получить к нему доступ.
P.S. Хотите полностью автоматизировать работу с журналами событий? Попробуйте новую версию NetWrix Event Log Manager 4.0, которая осуществляет сбор и архивирование журналов событий, строит отчеты и генерирует оповещения в режиме реального времени. Программа собирает данные с многочисленных компьютеров сети, предупреждает Вас о критических событиях и централизованно хранит данные обо всех событиях в сжатом формате для удобства анализа архивных данных журналов. Доступна бесплатная версия программы для 10 контроллеров доменов и 100 компьютеров.
Regular reviewing of these Windows event logs alone or in combination might be your best chance to identify malicious activity early.
Monitoring Windows 10 event logs is one of the best ways to detect malicious activity on your network. Which event IDs should you watch? These are the most important types of log events to look for and what they can tell you.
Windows security event log ID 4688
Event 4688 documents each program a computer executes, its identifying data, and the process that started it. Several event 4688s occur on your system when you log into a system. For example, Session Manager Subsystem (SMSS.exe) launches at login and event 4688 is logged. In addition, the logged token elevation type shows what user rights are associated with the program. As noted in Randy Franklin Smith’s Windows security blog, these tokens showcase the account rights.
- %%1936 – Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control (UAC) is disabled or if the user is the built-in administrator account or a service account.
- %%1937 – Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when UAC is enabled and the user chooses to start the program using “Run as administrator”. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the administrators group.
- %%1938 – Type 3 is the normal value when UAC is enabled and a user simply starts a program from the Start menu. It’s a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when the application does not require administrative privilege and the user does not choose to start the program with “Run as administrator”.
Because event 4688 represents normal system activity task, it’s of limited use alone to track the source of an attack. However, this event is often associated with other events that occur when an attacker tries to take over a machine, such as those listed below. Event 4688 is often happens first during an attack sequence, indicating that an attacker has launched an application before beginning another event.
Windows security event log ID 1102
Event 1102 relates to clearing the audit log. You should never see event 1102 in your audit logs unless you have cleared the log intentionally. Attackers often clear audit logs to cover their tracks. You’ll want to know what user cleared the log as this will be an indicator of account takeover. You may even want to set up an alert when this event occurs.
Windows security event log ID 4670
A user changing an object’s access control list triggers event 4670. Attackers often elevate privileges and change permissions to perform ransomware attacks or move laterally. Tracking who (or what) takes ownership is a key event to follow. You’ll also want to enable the object’s audit policy, especially for “Write DAC”/”Change Permissions” or “Take Ownership” permissions.
Windows security event log ID 4672
Event 4672 indicates a possible pass-the-hash or other elevation of privilege attacks, such as using a tool like Mimikatz. Combined with event 4624, which shows a user has logged into an account, these two events may need additional review to ensure that such attack isn’t occurring in your network.
Event 4672 means “Special privileges assigned to new logon”. This event is aligned with a system account is typically normal. If the event is aligned with a standard user account, someone who is logging into a system, you may need to investigate to determine if the account was breached and is being used in a lateral attack.
As Microsoft notes, “monitor for this event where ‘SubjectSecurity ID’ is not one of these well-known security principals: LOCAL SYSTEM, NETWORK SERVICE, LOCAL SERVICE, and where “SubjectSecurity ID” is not an administrative account that is expected to have the listed Privileges.”
Several other events combined suggest a pass-the-hash attack. As noted in this blog, it’s wise to baseline your environment to know what events are normal for your network. The table below shows the events that occur during a pass-the-hash attack.
CSO / IDG
Install Sysmon on all systems it will help you find the additional events associated with pass-the-hash attacks.
Windows Defender events
Review the events surrounding Windows Defender–for example, event ID 1006. This is triggered when Defender sees malware or other unwanted software. Also look for Event 1007 “The antimalware platform performed an action to protect your system from malware or other potentially unwanted software.” Defender events are in a sub log. To review these events, open Event Viewer. Then in the console tree, expand “Applications and Services Logs”, then “Microsoft”, then “Windows”, then “Windows Defender Antivirus”. Double-click on “Operational”. Look for your event In the Details pane and click on it to see details.
Susan Bradley Reviewing WIndows Defender events
Take the time to baseline your computer systems and know what events are normal.
1100
The event logging service has shut down
1101
Audit events have been dropped by the transport.
1102
The audit log was cleared
1104
The security Log is now full
1105
Event log automatic backup
1108
The event logging service encountered an error
4608
Windows is starting up
4609
Windows is shutting down
4610
An authentication package has been loaded by the Local Security Authority
4611
A trusted logon process has been registered with the Local Security Authority
4612
Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits.
4614
A notification package has been loaded by the Security Account Manager.
4615
Invalid use of LPC port
4616
The system time was changed.
4618
A monitored security event pattern has occurred
4621
Administrator recovered system from CrashOnAuditFail
4622
A security package has been loaded by the Local Security Authority.
4624
An account was successfully logged on
4625
An account failed to log on
4626
User/Device claims information
4627
Group membership information.
4634
An account was logged off
4646
IKE DoS-prevention mode started
4647
User initiated logoff
4648
A logon was attempted using explicit credentials
4649
A replay attack was detected
4650
An IPsec Main Mode security association was established
4651
An IPsec Main Mode security association was established
4652
An IPsec Main Mode negotiation failed
4653
An IPsec Main Mode negotiation failed
4654
An IPsec Quick Mode negotiation failed
4655
An IPsec Main Mode security association ended
4656
A handle to an object was requested
4657
A registry value was modified
4658
The handle to an object was closed
4659
A handle to an object was requested with intent to delete
4660
An object was deleted
4661
A handle to an object was requested
4662
An operation was performed on an object
4663
An attempt was made to access an object
4664
An attempt was made to create a hard link
4665
An attempt was made to create an application client context.
4666
An application attempted an operation
4667
An application client context was deleted
4668
An application was initialized
4670
Permissions on an object were changed
4671
An application attempted to access a blocked ordinal through the TBS
4672
Special privileges assigned to new logon
4673
A privileged service was called
4674
An operation was attempted on a privileged object
4675
SIDs were filtered
4688
A new process has been created
4689
A process has exited
4690
An attempt was made to duplicate a handle to an object
4691
Indirect access to an object was requested
4692
Backup of data protection master key was attempted
4693
Recovery of data protection master key was attempted
4694
Protection of auditable protected data was attempted
4695
Unprotection of auditable protected data was attempted
4696
A primary token was assigned to process
4697
A service was installed in the system
4698
A scheduled task was created
4699
A scheduled task was deleted
4700
A scheduled task was enabled
4701
A scheduled task was disabled
4702
A scheduled task was updated
4703
A token right was adjusted
4704
A user right was assigned
4705
A user right was removed
4706
A new trust was created to a domain
4707
A trust to a domain was removed
4709
IPsec Services was started
4710
IPsec Services was disabled
4711
PAStore Engine (1%)
4712
IPsec Services encountered a potentially serious failure
4713
Kerberos policy was changed
4714
Encrypted data recovery policy was changed
4715
The audit policy (SACL) on an object was changed
4716
Trusted domain information was modified
4717
System security access was granted to an account
4718
System security access was removed from an account
4719
System audit policy was changed
4720
A user account was created
4722
A user account was enabled
4723
An attempt was made to change an account’s password
4724
An attempt was made to reset an accounts password
4725
A user account was disabled
4726
A user account was deleted
4727
A security-enabled global group was created
4728
A member was added to a security-enabled global group
4729
A member was removed from a security-enabled global group
4730
A security-enabled global group was deleted
4731
A security-enabled local group was created
4732
A member was added to a security-enabled local group
4733
A member was removed from a security-enabled local group
4734
A security-enabled local group was deleted
4735
A security-enabled local group was changed
4737
A security-enabled global group was changed
4738
A user account was changed
4739
Domain Policy was changed
4740
A user account was locked out
4741
A computer account was created
4742
A computer account was changed
4743
A computer account was deleted
4744
A security-disabled local group was created
4745
A security-disabled local group was changed
4746
A member was added to a security-disabled local group
4747
A member was removed from a security-disabled local group
4748
A security-disabled local group was deleted
4749
A security-disabled global group was created
4750
A security-disabled global group was changed
4751
A member was added to a security-disabled global group
4752
A member was removed from a security-disabled global group
4753
A security-disabled global group was deleted
4754
A security-enabled universal group was created
4755
A security-enabled universal group was changed
4756
A member was added to a security-enabled universal group
4757
A member was removed from a security-enabled universal group
4758
A security-enabled universal group was deleted
4759
A security-disabled universal group was created
4760
A security-disabled universal group was changed
4761
A member was added to a security-disabled universal group
4762
A member was removed from a security-disabled universal group
4763
A security-disabled universal group was deleted
4764
A groups type was changed
4765
SID History was added to an account
4766
An attempt to add SID History to an account failed
4767
A user account was unlocked
4768
A Kerberos authentication ticket (TGT) was requested
4769
A Kerberos service ticket was requested
4770
A Kerberos service ticket was renewed
4771
Kerberos pre-authentication failed
4772
A Kerberos authentication ticket request failed
4773
A Kerberos service ticket request failed
4774
An account was mapped for logon
4775
An account could not be mapped for logon
4776
The domain controller attempted to validate the credentials for an account
4777
The domain controller failed to validate the credentials for an account
4778
A session was reconnected to a Window Station
4779
A session was disconnected from a Window Station
4780
The ACL was set on accounts which are members of administrators groups
4781
The name of an account was changed
4782
The password hash an account was accessed
4783
A basic application group was created
4784
A basic application group was changed
4785
A member was added to a basic application group
4786
A member was removed from a basic application group
4787
A non-member was added to a basic application group
4788
A non-member was removed from a basic application group..
4789
A basic application group was deleted
4790
An LDAP query group was created
4791
A basic application group was changed
4792
An LDAP query group was deleted
4793
The Password Policy Checking API was called
4794
An attempt was made to set the Directory Services Restore Mode administrator password
4797
An attempt was made to query the existence of a blank password for an account
4798
A user’s local group membership was enumerated.
4799
A security-enabled local group membership was enumerated
4800
The workstation was locked
4801
The workstation was unlocked
4802
The screen saver was invoked
4803
The screen saver was dismissed
4816
RPC detected an integrity violation while decrypting an incoming message
4817
Auditing settings on object were changed.
4818
Proposed Central Access Policy does not grant the same access permissions as the current Central Access Policy
4819
Central Access Policies on the machine have been changed
4820
A Kerberos Ticket-granting-ticket (TGT) was denied because the device does not meet the access control restrictions
4821
A Kerberos service ticket was denied because the user, device, or both does not meet the access control restrictions
4822
NTLM authentication failed because the account was a member of the Protected User group
4823
NTLM authentication failed because access control restrictions are required
4824
Kerberos preauthentication by using DES or RC4 failed because the account was a member of the Protected User group
4825
A user was denied the access to Remote Desktop. By default, users are allowed to connect only if they are members of the Remote Desktop Users group or Administrators group
4826
Boot Configuration Data loaded
4830
SID History was removed from an account
4864
A namespace collision was detected
4865
A trusted forest information entry was added
4866
A trusted forest information entry was removed
4867
A trusted forest information entry was modified
4868
The certificate manager denied a pending certificate request
4869
Certificate Services received a resubmitted certificate request
4870
Certificate Services revoked a certificate
4871
Certificate Services received a request to publish the certificate revocation list (CRL)
4872
Certificate Services published the certificate revocation list (CRL)
4873
A certificate request extension changed
4874
One or more certificate request attributes changed.
4875
Certificate Services received a request to shut down
4876
Certificate Services backup started
4877
Certificate Services backup completed
4878
Certificate Services restore started
4879
Certificate Services restore completed
4880
Certificate Services started
4881
Certificate Services stopped
4882
The security permissions for Certificate Services changed
4883
Certificate Services retrieved an archived key
4884
Certificate Services imported a certificate into its database
4885
The audit filter for Certificate Services changed
4886
Certificate Services received a certificate request
4887
Certificate Services approved a certificate request and issued a certificate
4888
Certificate Services denied a certificate request
4889
Certificate Services set the status of a certificate request to pending
4890
The certificate manager settings for Certificate Services changed.
4891
A configuration entry changed in Certificate Services
4892
A property of Certificate Services changed
4893
Certificate Services archived a key
4894
Certificate Services imported and archived a key
4895
Certificate Services published the CA certificate to Active Directory Domain Services
4896
One or more rows have been deleted from the certificate database
4897
Role separation enabled
4898
Certificate Services loaded a template
4899
A Certificate Services template was updated
4900
Certificate Services template security was updated
4902
The Per-user audit policy table was created
4904
An attempt was made to register a security event source
4905
An attempt was made to unregister a security event source
4906
The CrashOnAuditFail value has changed
4907
Auditing settings on object were changed
4908
Special Groups Logon table modified
4909
The local policy settings for the TBS were changed
4910
The group policy settings for the TBS were changed
4911
Resource attributes of the object were changed
4912
Per User Audit Policy was changed
4913
Central Access Policy on the object was changed
4928
An Active Directory replica source naming context was established
4929
An Active Directory replica source naming context was removed
4930
An Active Directory replica source naming context was modified
4931
An Active Directory replica destination naming context was modified
4932
Synchronization of a replica of an Active Directory naming context has begun
4933
Synchronization of a replica of an Active Directory naming context has ended
4934
Attributes of an Active Directory object were replicated
4935
Replication failure begins
4936
Replication failure ends
4937
A lingering object was removed from a replica
4944
The following policy was active when the Windows Firewall started
4945
A rule was listed when the Windows Firewall started
4946
A change has been made to Windows Firewall exception list. A rule was added
4947
A change has been made to Windows Firewall exception list. A rule was modified
4948
A change has been made to Windows Firewall exception list. A rule was deleted
4949
Windows Firewall settings were restored to the default values
4950
A Windows Firewall setting has changed
4951
A rule has been ignored because its major version number was not recognized by Windows Firewall
4952
Parts of a rule have been ignored because its minor version number was not recognized by Windows Firewall
4953
A rule has been ignored by Windows Firewall because it could not parse the rule
4954
Windows Firewall Group Policy settings has changed. The new settings have been applied
4956
Windows Firewall has changed the active profile
4957
Windows Firewall did not apply the following rule
4958
Windows Firewall did not apply the following rule because the rule referred to items not configured on this computer
4960
IPsec dropped an inbound packet that failed an integrity check
4961
IPsec dropped an inbound packet that failed a replay check
4962
IPsec dropped an inbound packet that failed a replay check
4963
IPsec dropped an inbound clear text packet that should have been secured
4964
Special groups have been assigned to a new logon
4965
IPsec received a packet from a remote computer with an incorrect Security Parameter Index (SPI).
4976
During Main Mode negotiation, IPsec received an invalid negotiation packet.
4977
During Quick Mode negotiation, IPsec received an invalid negotiation packet.
4978
During Extended Mode negotiation, IPsec received an invalid negotiation packet.
4979
IPsec Main Mode and Extended Mode security associations were established.
4980
IPsec Main Mode and Extended Mode security associations were established
4981
IPsec Main Mode and Extended Mode security associations were established
4982
IPsec Main Mode and Extended Mode security associations were established
4983
An IPsec Extended Mode negotiation failed
4984
An IPsec Extended Mode negotiation failed
4985
The state of a transaction has changed
5024
The Windows Firewall Service has started successfully
5025
The Windows Firewall Service has been stopped
5027
The Windows Firewall Service was unable to retrieve the security policy from the local storage
5028
The Windows Firewall Service was unable to parse the new security policy.
5029
The Windows Firewall Service failed to initialize the driver
5030
The Windows Firewall Service failed to start
5031
The Windows Firewall Service blocked an application from accepting incoming connections on the network.
5032
Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network
5033
The Windows Firewall Driver has started successfully
5034
The Windows Firewall Driver has been stopped
5035
The Windows Firewall Driver failed to start
5037
The Windows Firewall Driver detected critical runtime error. Terminating
5038
Code integrity determined that the image hash of a file is not valid
5039
A registry key was virtualized.
5040
A change has been made to IPsec settings. An Authentication Set was added.
5041
A change has been made to IPsec settings. An Authentication Set was modified
5042
A change has been made to IPsec settings. An Authentication Set was deleted
5043
A change has been made to IPsec settings. A Connection Security Rule was added
5044
A change has been made to IPsec settings. A Connection Security Rule was modified
5045
A change has been made to IPsec settings. A Connection Security Rule was deleted
5046
A change has been made to IPsec settings. A Crypto Set was added
5047
A change has been made to IPsec settings. A Crypto Set was modified
5048
A change has been made to IPsec settings. A Crypto Set was deleted
5049
An IPsec Security Association was deleted
5050
An attempt to programmatically disable the Windows Firewall using a call to INetFwProfile.FirewallEnabled(FALSE
5051
A file was virtualized
5056
A cryptographic self test was performed
5057
A cryptographic primitive operation failed
5058
Key file operation
5059
Key migration operation
5060
Verification operation failed
5061
Cryptographic operation
5062
A kernel-mode cryptographic self test was performed
5063
A cryptographic provider operation was attempted
5064
A cryptographic context operation was attempted
5065
A cryptographic context modification was attempted
5066
A cryptographic function operation was attempted
5067
A cryptographic function modification was attempted
5068
A cryptographic function provider operation was attempted
5069
A cryptographic function property operation was attempted
5070
A cryptographic function property operation was attempted
5071
Key access denied by Microsoft key distribution service
5120
OCSP Responder Service Started
5121
OCSP Responder Service Stopped
5122
A Configuration entry changed in the OCSP Responder Service
5123
A configuration entry changed in the OCSP Responder Service
5124
A security setting was updated on OCSP Responder Service
5125
A request was submitted to OCSP Responder Service
5126
Signing Certificate was automatically updated by the OCSP Responder Service
5127
The OCSP Revocation Provider successfully updated the revocation information
5136
A directory service object was modified
5137
A directory service object was created
5138
A directory service object was undeleted
5139
A directory service object was moved
5140
A network share object was accessed
5141
A directory service object was deleted
5142
A network share object was added.
5143
A network share object was modified
5144
A network share object was deleted.
5145
A network share object was checked to see whether client can be granted desired access
5146
The Windows Filtering Platform has blocked a packet
5147
A more restrictive Windows Filtering Platform filter has blocked a packet
5148
The Windows Filtering Platform has detected a DoS attack and entered a defensive mode; packets associated with this attack will be discarded.
5149
The DoS attack has subsided and normal processing is being resumed.
5150
The Windows Filtering Platform has blocked a packet.
5151
A more restrictive Windows Filtering Platform filter has blocked a packet.
5152
The Windows Filtering Platform blocked a packet
5153
A more restrictive Windows Filtering Platform filter has blocked a packet
5154
The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections
5155
The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections
5156
The Windows Filtering Platform has allowed a connection
5157
The Windows Filtering Platform has blocked a connection
5158
The Windows Filtering Platform has permitted a bind to a local port
5159
The Windows Filtering Platform has blocked a bind to a local port
5168
Spn check for SMB/SMB2 fails.
5169
A directory service object was modified
5170
A directory service object was modified during a background cleanup task
5376
Credential Manager credentials were backed up
5377
Credential Manager credentials were restored from a backup
5378
The requested credentials delegation was disallowed by policy
5379
Credential Manager credentials were read
5380
Vault Find Credential
5381
Vault credentials were read
5382
Vault credentials were read
5440
The following callout was present when the Windows Filtering Platform Base Filtering Engine started
5441
The following filter was present when the Windows Filtering Platform Base Filtering Engine started
5442
The following provider was present when the Windows Filtering Platform Base Filtering Engine started
5443
The following provider context was present when the Windows Filtering Platform Base Filtering Engine started
5444
The following sub-layer was present when the Windows Filtering Platform Base Filtering Engine started
5446
A Windows Filtering Platform callout has been changed
5447
A Windows Filtering Platform filter has been changed
5448
A Windows Filtering Platform provider has been changed
5449
A Windows Filtering Platform provider context has been changed
5450
A Windows Filtering Platform sub-layer has been changed
5451
An IPsec Quick Mode security association was established
5452
An IPsec Quick Mode security association ended
5453
An IPsec negotiation with a remote computer failed because the IKE and AuthIP IPsec Keying Modules (IKEEXT) service is not started
5456
PAStore Engine applied Active Directory storage IPsec policy on the computer
5457
PAStore Engine failed to apply Active Directory storage IPsec policy on the computer
5458
PAStore Engine applied locally cached copy of Active Directory storage IPsec policy on the computer
5459
PAStore Engine failed to apply locally cached copy of Active Directory storage IPsec policy on the computer
5460
PAStore Engine applied local registry storage IPsec policy on the computer
5461
PAStore Engine failed to apply local registry storage IPsec policy on the computer
5462
PAStore Engine failed to apply some rules of the active IPsec policy on the computer
5463
PAStore Engine polled for changes to the active IPsec policy and detected no changes
5464
PAStore Engine polled for changes to the active IPsec policy, detected changes, and applied them to IPsec Services
5465
PAStore Engine received a control for forced reloading of IPsec policy and processed the control successfully
5466
PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory cannot be reached, and will use the cached copy of the Active Directory IPsec policy instead
5467
PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, and found no changes to the policy
5468
PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, found changes to the policy, and applied those changes
5471
PAStore Engine loaded local storage IPsec policy on the computer
5472
PAStore Engine failed to load local storage IPsec policy on the computer
5473
PAStore Engine loaded directory storage IPsec policy on the computer
5474
PAStore Engine failed to load directory storage IPsec policy on the computer
5477
PAStore Engine failed to add quick mode filter
5478
IPsec Services has started successfully
5479
IPsec Services has been shut down successfully
5480
IPsec Services failed to get the complete list of network interfaces on the computer
5483
IPsec Services failed to initialize RPC server. IPsec Services could not be started
5484
IPsec Services has experienced a critical failure and has been shut down
5485
IPsec Services failed to process some IPsec filters on a plug-and-play event for network interfaces
5632
A request was made to authenticate to a wireless network
5633
A request was made to authenticate to a wired network
5712
A Remote Procedure Call (RPC) was attempted
5888
An object in the COM+ Catalog was modified
5889
An object was deleted from the COM+ Catalog
5890
An object was added to the COM+ Catalog
6144
Security policy in the group policy objects has been applied successfully
6145
One or more errors occurred while processing security policy in the group policy objects
6272
Network Policy Server granted access to a user
6273
Network Policy Server denied access to a user
6274
Network Policy Server discarded the request for a user
6275
Network Policy Server discarded the accounting request for a user
6276
Network Policy Server quarantined a user
6277
Network Policy Server granted access to a user but put it on probation because the host did not meet the defined health policy
6278
Network Policy Server granted full access to a user because the host met the defined health policy
6279
Network Policy Server locked the user account due to repeated failed authentication attempts
6280
Network Policy Server unlocked the user account
6281
Code Integrity determined that the page hashes of an image file are not valid…
6400
BranchCache: Received an incorrectly formatted response while discovering availability of content.
6401
BranchCache: Received invalid data from a peer. Data discarded.
6402
BranchCache: The message to the hosted cache offering it data is incorrectly formatted.
6403
BranchCache: The hosted cache sent an incorrectly formatted response to the client’s message to offer it data.
6404
BranchCache: Hosted cache could not be authenticated using the provisioned SSL certificate.
6405
BranchCache: %2 instance(s) of event id %1 occurred.
6406
%1 registered to Windows Firewall to control filtering for the following:
6407
%1
6408
Registered product %1 failed and Windows Firewall is now controlling the filtering for %2.
6409
BranchCache: A service connection point object could not be parsed
6410
Code integrity determined that a file does not meet the security requirements to load into a process. This could be due to the use of shared sections or other issues
6416
A new external device was recognized by the system.
6417
The FIPS mode crypto selftests succeeded
6418
The FIPS mode crypto selftests failed
6419
A request was made to disable a device
6420
A device was disabled
6421
A request was made to enable a device
6422
A device was enabled
6423
The installation of this device is forbidden by system policy
6424
The installation of this device was allowed, after having previously been forbidden by policy
8191
Highest System-Defined Audit Message Value
| Windows |
1100 |
The event logging service has shut down |
| Windows |
1101 |
Audit events have been dropped by the transport. |
| Windows |
1102 |
The audit log was cleared |
| Windows |
1104 |
The security Log is now full |
| Windows |
1105 |
Event log automatic backup |
| Windows |
1108 |
The event logging service encountered an error |
| Windows |
4608 |
Windows is starting up |
| Windows |
4609 |
Windows is shutting down |
| Windows |
4610 |
An authentication package has been loaded by the Local Security Authority |
| Windows |
4611 |
A trusted logon process has been registered with the Local Security Authority |
| Windows |
4612 |
Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits. |
| Windows |
4614 |
A notification package has been loaded by the Security Account Manager. |
| Windows |
4615 |
Invalid use of LPC port |
| Windows |
4616 |
The system time was changed. |
| Windows |
4618 |
A monitored security event pattern has occurred |
| Windows |
4621 |
Administrator recovered system from CrashOnAuditFail |
| Windows |
4622 |
A security package has been loaded by the Local Security Authority. |
| Windows |
4624 |
An account was successfully logged on |
| Windows |
4625 |
An account failed to log on |
| Windows |
4626 |
User/Device claims information |
| Windows |
4627 |
Group membership information. |
| Windows |
4634 |
An account was logged off |
| Windows |
4646 |
IKE DoS-prevention mode started |
| Windows |
4647 |
User initiated logoff |
| Windows |
4648 |
A logon was attempted using explicit credentials |
| Windows |
4649 |
A replay attack was detected |
| Windows |
4650 |
An IPsec Main Mode security association was established |
| Windows |
4651 |
An IPsec Main Mode security association was established |
| Windows |
4652 |
An IPsec Main Mode negotiation failed |
| Windows |
4653 |
An IPsec Main Mode negotiation failed |
| Windows |
4654 |
An IPsec Quick Mode negotiation failed |
| Windows |
4655 |
An IPsec Main Mode security association ended |
| Windows |
4656 |
A handle to an object was requested |
| Windows |
4657 |
A registry value was modified |
| Windows |
4658 |
The handle to an object was closed |
| Windows |
4659 |
A handle to an object was requested with intent to delete |
| Windows |
4660 |
An object was deleted |
| Windows |
4661 |
A handle to an object was requested |
| Windows |
4662 |
An operation was performed on an object |
| Windows |
4663 |
An attempt was made to access an object |
| Windows |
4664 |
An attempt was made to create a hard link |
| Windows |
4665 |
An attempt was made to create an application client context. |
| Windows |
4666 |
An application attempted an operation |
| Windows |
4667 |
An application client context was deleted |
| Windows |
4668 |
An application was initialized |
| Windows |
4670 |
Permissions on an object were changed |
| Windows |
4671 |
An application attempted to access a blocked ordinal through the TBS |
| Windows |
4672 |
Special privileges assigned to new logon |
| Windows |
4673 |
A privileged service was called |
| Windows |
4674 |
An operation was attempted on a privileged object |
| Windows |
4675 |
SIDs were filtered |
| Windows |
4688 |
A new process has been created |
| Windows |
4689 |
A process has exited |
| Windows |
4690 |
An attempt was made to duplicate a handle to an object |
| Windows |
4691 |
Indirect access to an object was requested |
| Windows |
4692 |
Backup of data protection master key was attempted |
| Windows |
4693 |
Recovery of data protection master key was attempted |
| Windows |
4694 |
Protection of auditable protected data was attempted |
| Windows |
4695 |
Unprotection of auditable protected data was attempted |
| Windows |
4696 |
A primary token was assigned to process |
| Windows |
4697 |
A service was installed in the system |
| Windows |
4698 |
A scheduled task was created |
| Windows |
4699 |
A scheduled task was deleted |
| Windows |
4700 |
A scheduled task was enabled |
| Windows |
4701 |
A scheduled task was disabled |
| Windows |
4702 |
A scheduled task was updated |
| Windows |
4703 |
A token right was adjusted |
| Windows |
4704 |
A user right was assigned |
| Windows |
4705 |
A user right was removed |
| Windows |
4706 |
A new trust was created to a domain |
| Windows |
4707 |
A trust to a domain was removed |
| Windows |
4709 |
IPsec Services was started |
| Windows |
4710 |
IPsec Services was disabled |
| Windows |
4711 |
PAStore Engine (1%) |
| Windows |
4712 |
IPsec Services encountered a potentially serious failure |
| Windows |
4713 |
Kerberos policy was changed |
| Windows |
4714 |
Encrypted data recovery policy was changed |
| Windows |
4715 |
The audit policy (SACL) on an object was changed |
| Windows |
4716 |
Trusted domain information was modified |
| Windows |
4717 |
System security access was granted to an account |
| Windows |
4718 |
System security access was removed from an account |
| Windows |
4719 |
System audit policy was changed |
| Windows |
4720 |
A user account was created |
| Windows |
4722 |
A user account was enabled |
| Windows |
4723 |
An attempt was made to change an account’s password |
| Windows |
4724 |
An attempt was made to reset an accounts password |
| Windows |
4725 |
A user account was disabled |
| Windows |
4726 |
A user account was deleted |
| Windows |
4727 |
A security-enabled global group was created |
| Windows |
4728 |
A member was added to a security-enabled global group |
| Windows |
4729 |
A member was removed from a security-enabled global group |
| Windows |
4730 |
A security-enabled global group was deleted |
| Windows |
4731 |
A security-enabled local group was created |
| Windows |
4732 |
A member was added to a security-enabled local group |
| Windows |
4733 |
A member was removed from a security-enabled local group |
| Windows |
4734 |
A security-enabled local group was deleted |
| Windows |
4735 |
A security-enabled local group was changed |
| Windows |
4737 |
A security-enabled global group was changed |
| Windows |
4738 |
A user account was changed |
| Windows |
4739 |
Domain Policy was changed |
| Windows |
4740 |
A user account was locked out |
| Windows |
4741 |
A computer account was created |
| Windows |
4742 |
A computer account was changed |
| Windows |
4743 |
A computer account was deleted |
| Windows |
4744 |
A security-disabled local group was created |
| Windows |
4745 |
A security-disabled local group was changed |
| Windows |
4746 |
A member was added to a security-disabled local group |
| Windows |
4747 |
A member was removed from a security-disabled local group |
| Windows |
4748 |
A security-disabled local group was deleted |
| Windows |
4749 |
A security-disabled global group was created |
| Windows |
4750 |
A security-disabled global group was changed |
| Windows |
4751 |
A member was added to a security-disabled global group |
| Windows |
4752 |
A member was removed from a security-disabled global group |
| Windows |
4753 |
A security-disabled global group was deleted |
| Windows |
4754 |
A security-enabled universal group was created |
| Windows |
4755 |
A security-enabled universal group was changed |
| Windows |
4756 |
A member was added to a security-enabled universal group |
| Windows |
4757 |
A member was removed from a security-enabled universal group |
| Windows |
4758 |
A security-enabled universal group was deleted |
| Windows |
4759 |
A security-disabled universal group was created |
| Windows |
4760 |
A security-disabled universal group was changed |
| Windows |
4761 |
A member was added to a security-disabled universal group |
| Windows |
4762 |
A member was removed from a security-disabled universal group |
| Windows |
4763 |
A security-disabled universal group was deleted |
| Windows |
4764 |
A groups type was changed |
| Windows |
4765 |
SID History was added to an account |
| Windows |
4766 |
An attempt to add SID History to an account failed |
| Windows |
4767 |
A user account was unlocked |
| Windows |
4768 |
A Kerberos authentication ticket (TGT) was requested |
| Windows |
4769 |
A Kerberos service ticket was requested |
| Windows |
4770 |
A Kerberos service ticket was renewed |
| Windows |
4771 |
Kerberos pre-authentication failed |
| Windows |
4772 |
A Kerberos authentication ticket request failed |
| Windows |
4773 |
A Kerberos service ticket request failed |
| Windows |
4774 |
An account was mapped for logon |
| Windows |
4775 |
An account could not be mapped for logon |
| Windows |
4776 |
The domain controller attempted to validate the credentials for an account |
| Windows |
4777 |
The domain controller failed to validate the credentials for an account |
| Windows |
4778 |
A session was reconnected to a Window Station |
| Windows |
4779 |
A session was disconnected from a Window Station |
| Windows |
4780 |
The ACL was set on accounts which are members of administrators groups |
| Windows |
4781 |
The name of an account was changed |
| Windows |
4782 |
The password hash an account was accessed |
| Windows |
4783 |
A basic application group was created |
| Windows |
4784 |
A basic application group was changed |
| Windows |
4785 |
A member was added to a basic application group |
| Windows |
4786 |
A member was removed from a basic application group |
| Windows |
4787 |
A non-member was added to a basic application group |
| Windows |
4788 |
A non-member was removed from a basic application group.. |
| Windows |
4789 |
A basic application group was deleted |
| Windows |
4790 |
An LDAP query group was created |
| Windows |
4791 |
A basic application group was changed |
| Windows |
4792 |
An LDAP query group was deleted |
| Windows |
4793 |
The Password Policy Checking API was called |
| Windows |
4794 |
An attempt was made to set the Directory Services Restore Mode administrator password |
| Windows |
4797 |
An attempt was made to query the existence of a blank password for an account |
| Windows |
4798 |
A user’s local group membership was enumerated. |
| Windows |
4799 |
A security-enabled local group membership was enumerated |
| Windows |
4800 |
The workstation was locked |
| Windows |
4801 |
The workstation was unlocked |
| Windows |
4802 |
The screen saver was invoked |
| Windows |
4803 |
The screen saver was dismissed |
| Windows |
4816 |
RPC detected an integrity violation while decrypting an incoming message |
| Windows |
4817 |
Auditing settings on object were changed. |
| Windows |
4818 |
Proposed Central Access Policy does not grant the same access permissions as the current Central Access Policy |
| Windows |
4819 |
Central Access Policies on the machine have been changed |
| Windows |
4820 |
A Kerberos Ticket-granting-ticket (TGT) was denied because the device does not meet the access control restrictions |
| Windows |
4821 |
A Kerberos service ticket was denied because the user, device, or both does not meet the access control restrictions |
| Windows |
4822 |
NTLM authentication failed because the account was a member of the Protected User group |
| Windows |
4823 |
NTLM authentication failed because access control restrictions are required |
| Windows |
4824 |
Kerberos preauthentication by using DES or RC4 failed because the account was a member of the Protected User group |
| Windows |
4825 |
A user was denied the access to Remote Desktop. By default, users are allowed to connect only if they are members of the Remote Desktop Users group or Administrators group |
| Windows |
4826 |
Boot Configuration Data loaded |
| Windows |
4830 |
SID History was removed from an account |
| Windows |
4864 |
A namespace collision was detected |
| Windows |
4865 |
A trusted forest information entry was added |
| Windows |
4866 |
A trusted forest information entry was removed |
| Windows |
4867 |
A trusted forest information entry was modified |
| Windows |
4868 |
The certificate manager denied a pending certificate request |
| Windows |
4869 |
Certificate Services received a resubmitted certificate request |
| Windows |
4870 |
Certificate Services revoked a certificate |
| Windows |
4871 |
Certificate Services received a request to publish the certificate revocation list (CRL) |
| Windows |
4872 |
Certificate Services published the certificate revocation list (CRL) |
| Windows |
4873 |
A certificate request extension changed |
| Windows |
4874 |
One or more certificate request attributes changed. |
| Windows |
4875 |
Certificate Services received a request to shut down |
| Windows |
4876 |
Certificate Services backup started |
| Windows |
4877 |
Certificate Services backup completed |
| Windows |
4878 |
Certificate Services restore started |
| Windows |
4879 |
Certificate Services restore completed |
| Windows |
4880 |
Certificate Services started |
| Windows |
4881 |
Certificate Services stopped |
| Windows |
4882 |
The security permissions for Certificate Services changed |
| Windows |
4883 |
Certificate Services retrieved an archived key |
| Windows |
4884 |
Certificate Services imported a certificate into its database |
| Windows |
4885 |
The audit filter for Certificate Services changed |
| Windows |
4886 |
Certificate Services received a certificate request |
| Windows |
4887 |
Certificate Services approved a certificate request and issued a certificate |
| Windows |
4888 |
Certificate Services denied a certificate request |
| Windows |
4889 |
Certificate Services set the status of a certificate request to pending |
| Windows |
4890 |
The certificate manager settings for Certificate Services changed. |
| Windows |
4891 |
A configuration entry changed in Certificate Services |
| Windows |
4892 |
A property of Certificate Services changed |
| Windows |
4893 |
Certificate Services archived a key |
| Windows |
4894 |
Certificate Services imported and archived a key |
| Windows |
4895 |
Certificate Services published the CA certificate to Active Directory Domain Services |
| Windows |
4896 |
One or more rows have been deleted from the certificate database |
| Windows |
4897 |
Role separation enabled |
| Windows |
4898 |
Certificate Services loaded a template |
| Windows |
4899 |
A Certificate Services template was updated |
| Windows |
4900 |
Certificate Services template security was updated |
| Windows |
4902 |
The Per-user audit policy table was created |
| Windows |
4904 |
An attempt was made to register a security event source |
| Windows |
4905 |
An attempt was made to unregister a security event source |
| Windows |
4906 |
The CrashOnAuditFail value has changed |
| Windows |
4907 |
Auditing settings on object were changed |
| Windows |
4908 |
Special Groups Logon table modified |
| Windows |
4909 |
The local policy settings for the TBS were changed |
| Windows |
4910 |
The group policy settings for the TBS were changed |
| Windows |
4911 |
Resource attributes of the object were changed |
| Windows |
4912 |
Per User Audit Policy was changed |
| Windows |
4913 |
Central Access Policy on the object was changed |
| Windows |
4928 |
An Active Directory replica source naming context was established |
| Windows |
4929 |
An Active Directory replica source naming context was removed |
| Windows |
4930 |
An Active Directory replica source naming context was modified |
| Windows |
4931 |
An Active Directory replica destination naming context was modified |
| Windows |
4932 |
Synchronization of a replica of an Active Directory naming context has begun |
| Windows |
4933 |
Synchronization of a replica of an Active Directory naming context has ended |
| Windows |
4934 |
Attributes of an Active Directory object were replicated |
| Windows |
4935 |
Replication failure begins |
| Windows |
4936 |
Replication failure ends |
| Windows |
4937 |
A lingering object was removed from a replica |
| Windows |
4944 |
The following policy was active when the Windows Firewall started |
| Windows |
4945 |
A rule was listed when the Windows Firewall started |
| Windows |
4946 |
A change has been made to Windows Firewall exception list. A rule was added |
| Windows |
4947 |
A change has been made to Windows Firewall exception list. A rule was modified |
| Windows |
4948 |
A change has been made to Windows Firewall exception list. A rule was deleted |
| Windows |
4949 |
Windows Firewall settings were restored to the default values |
| Windows |
4950 |
A Windows Firewall setting has changed |
| Windows |
4951 |
A rule has been ignored because its major version number was not recognized by Windows Firewall |
| Windows |
4952 |
Parts of a rule have been ignored because its minor version number was not recognized by Windows Firewall |
| Windows |
4953 |
A rule has been ignored by Windows Firewall because it could not parse the rule |
| Windows |
4954 |
Windows Firewall Group Policy settings has changed. The new settings have been applied |
| Windows |
4956 |
Windows Firewall has changed the active profile |
| Windows |
4957 |
Windows Firewall did not apply the following rule |
| Windows |
4958 |
Windows Firewall did not apply the following rule because the rule referred to items not configured on this computer |
| Windows |
4960 |
IPsec dropped an inbound packet that failed an integrity check |
| Windows |
4961 |
IPsec dropped an inbound packet that failed a replay check |
| Windows |
4962 |
IPsec dropped an inbound packet that failed a replay check |
| Windows |
4963 |
IPsec dropped an inbound clear text packet that should have been secured |
| Windows |
4964 |
Special groups have been assigned to a new logon |
| Windows |
4965 |
IPsec received a packet from a remote computer with an incorrect Security Parameter Index (SPI). |
| Windows |
4976 |
During Main Mode negotiation, IPsec received an invalid negotiation packet. |
| Windows |
4977 |
During Quick Mode negotiation, IPsec received an invalid negotiation packet. |
| Windows |
4978 |
During Extended Mode negotiation, IPsec received an invalid negotiation packet. |
| Windows |
4979 |
IPsec Main Mode and Extended Mode security associations were established. |
| Windows |
4980 |
IPsec Main Mode and Extended Mode security associations were established |
| Windows |
4981 |
IPsec Main Mode and Extended Mode security associations were established |
| Windows |
4982 |
IPsec Main Mode and Extended Mode security associations were established |
| Windows |
4983 |
An IPsec Extended Mode negotiation failed |
| Windows |
4984 |
An IPsec Extended Mode negotiation failed |
| Windows |
4985 |
The state of a transaction has changed |
| Windows |
5024 |
The Windows Firewall Service has started successfully |
| Windows |
5025 |
The Windows Firewall Service has been stopped |
| Windows |
5027 |
The Windows Firewall Service was unable to retrieve the security policy from the local storage |
| Windows |
5028 |
The Windows Firewall Service was unable to parse the new security policy. |
| Windows |
5029 |
The Windows Firewall Service failed to initialize the driver |
| Windows |
5030 |
The Windows Firewall Service failed to start |
| Windows |
5031 |
The Windows Firewall Service blocked an application from accepting incoming connections on the network. |
| Windows |
5032 |
Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network |
| Windows |
5033 |
The Windows Firewall Driver has started successfully |
| Windows |
5034 |
The Windows Firewall Driver has been stopped |
| Windows |
5035 |
The Windows Firewall Driver failed to start |
| Windows |
5037 |
The Windows Firewall Driver detected critical runtime error. Terminating |
| Windows |
5038 |
Code integrity determined that the image hash of a file is not valid |
| Windows |
5039 |
A registry key was virtualized. |
| Windows |
5040 |
A change has been made to IPsec settings. An Authentication Set was added. |
| Windows |
5041 |
A change has been made to IPsec settings. An Authentication Set was modified |
| Windows |
5042 |
A change has been made to IPsec settings. An Authentication Set was deleted |
| Windows |
5043 |
A change has been made to IPsec settings. A Connection Security Rule was added |
| Windows |
5044 |
A change has been made to IPsec settings. A Connection Security Rule was modified |
| Windows |
5045 |
A change has been made to IPsec settings. A Connection Security Rule was deleted |
| Windows |
5046 |
A change has been made to IPsec settings. A Crypto Set was added |
| Windows |
5047 |
A change has been made to IPsec settings. A Crypto Set was modified |
| Windows |
5048 |
A change has been made to IPsec settings. A Crypto Set was deleted |
| Windows |
5049 |
An IPsec Security Association was deleted |
| Windows |
5050 |
An attempt to programmatically disable the Windows Firewall using a call to INetFwProfile.FirewallEnabled(FALSE |
| Windows |
5051 |
A file was virtualized |
| Windows |
5056 |
A cryptographic self test was performed |
| Windows |
5057 |
A cryptographic primitive operation failed |
| Windows |
5058 |
Key file operation |
| Windows |
5059 |
Key migration operation |
| Windows |
5060 |
Verification operation failed |
| Windows |
5061 |
Cryptographic operation |
| Windows |
5062 |
A kernel-mode cryptographic self test was performed |
| Windows |
5063 |
A cryptographic provider operation was attempted |
| Windows |
5064 |
A cryptographic context operation was attempted |
| Windows |
5065 |
A cryptographic context modification was attempted |
| Windows |
5066 |
A cryptographic function operation was attempted |
| Windows |
5067 |
A cryptographic function modification was attempted |
| Windows |
5068 |
A cryptographic function provider operation was attempted |
| Windows |
5069 |
A cryptographic function property operation was attempted |
| Windows |
5070 |
A cryptographic function property operation was attempted |
| Windows |
5071 |
Key access denied by Microsoft key distribution service |
| Windows |
5120 |
OCSP Responder Service Started |
| Windows |
5121 |
OCSP Responder Service Stopped |
| Windows |
5122 |
A Configuration entry changed in the OCSP Responder Service |
| Windows |
5123 |
A configuration entry changed in the OCSP Responder Service |
| Windows |
5124 |
A security setting was updated on OCSP Responder Service |
| Windows |
5125 |
A request was submitted to OCSP Responder Service |
| Windows |
5126 |
Signing Certificate was automatically updated by the OCSP Responder Service |
| Windows |
5127 |
The OCSP Revocation Provider successfully updated the revocation information |
| Windows |
5136 |
A directory service object was modified |
| Windows |
5137 |
A directory service object was created |
| Windows |
5138 |
A directory service object was undeleted |
| Windows |
5139 |
A directory service object was moved |
| Windows |
5140 |
A network share object was accessed |
| Windows |
5141 |
A directory service object was deleted |
| Windows |
5142 |
A network share object was added. |
| Windows |
5143 |
A network share object was modified |
| Windows |
5144 |
A network share object was deleted. |
| Windows |
5145 |
A network share object was checked to see whether client can be granted desired access |
| Windows |
5146 |
The Windows Filtering Platform has blocked a packet |
| Windows |
5147 |
A more restrictive Windows Filtering Platform filter has blocked a packet |
| Windows |
5148 |
The Windows Filtering Platform has detected a DoS attack and entered a defensive mode; packets associated with this attack will be discarded. |
| Windows |
5149 |
The DoS attack has subsided and normal processing is being resumed. |
| Windows |
5150 |
The Windows Filtering Platform has blocked a packet. |
| Windows |
5151 |
A more restrictive Windows Filtering Platform filter has blocked a packet. |
| Windows |
5152 |
The Windows Filtering Platform blocked a packet |
| Windows |
5153 |
A more restrictive Windows Filtering Platform filter has blocked a packet |
| Windows |
5154 |
The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections |
| Windows |
5155 |
The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections |
| Windows |
5156 |
The Windows Filtering Platform has allowed a connection |
| Windows |
5157 |
The Windows Filtering Platform has blocked a connection |
| Windows |
5158 |
The Windows Filtering Platform has permitted a bind to a local port |
| Windows |
5159 |
The Windows Filtering Platform has blocked a bind to a local port |
| Windows |
5168 |
Spn check for SMB/SMB2 fails. |
| Windows |
5169 |
A directory service object was modified |
| Windows |
5170 |
A directory service object was modified during a background cleanup task |
| Windows |
5376 |
Credential Manager credentials were backed up |
| Windows |
5377 |
Credential Manager credentials were restored from a backup |
| Windows |
5378 |
The requested credentials delegation was disallowed by policy |
| Windows |
5379 |
Credential Manager credentials were read |
| Windows |
5380 |
Vault Find Credential |
| Windows |
5381 |
Vault credentials were read |
| Windows |
5382 |
Vault credentials were read |
| Windows |
5440 |
The following callout was present when the Windows Filtering Platform Base Filtering Engine started |
| Windows |
5441 |
The following filter was present when the Windows Filtering Platform Base Filtering Engine started |
| Windows |
5442 |
The following provider was present when the Windows Filtering Platform Base Filtering Engine started |
| Windows |
5443 |
The following provider context was present when the Windows Filtering Platform Base Filtering Engine started |
| Windows |
5444 |
The following sub-layer was present when the Windows Filtering Platform Base Filtering Engine started |
| Windows |
5446 |
A Windows Filtering Platform callout has been changed |
| Windows |
5447 |
A Windows Filtering Platform filter has been changed |
| Windows |
5448 |
A Windows Filtering Platform provider has been changed |
| Windows |
5449 |
A Windows Filtering Platform provider context has been changed |
| Windows |
5450 |
A Windows Filtering Platform sub-layer has been changed |
| Windows |
5451 |
An IPsec Quick Mode security association was established |
| Windows |
5452 |
An IPsec Quick Mode security association ended |
| Windows |
5453 |
An IPsec negotiation with a remote computer failed because the IKE and AuthIP IPsec Keying Modules (IKEEXT) service is not started |
| Windows |
5456 |
PAStore Engine applied Active Directory storage IPsec policy on the computer |
| Windows |
5457 |
PAStore Engine failed to apply Active Directory storage IPsec policy on the computer |
| Windows |
5458 |
PAStore Engine applied locally cached copy of Active Directory storage IPsec policy on the computer |
| Windows |
5459 |
PAStore Engine failed to apply locally cached copy of Active Directory storage IPsec policy on the computer |
| Windows |
5460 |
PAStore Engine applied local registry storage IPsec policy on the computer |
| Windows |
5461 |
PAStore Engine failed to apply local registry storage IPsec policy on the computer |
| Windows |
5462 |
PAStore Engine failed to apply some rules of the active IPsec policy on the computer |
| Windows |
5463 |
PAStore Engine polled for changes to the active IPsec policy and detected no changes |
| Windows |
5464 |
PAStore Engine polled for changes to the active IPsec policy, detected changes, and applied them to IPsec Services |
| Windows |
5465 |
PAStore Engine received a control for forced reloading of IPsec policy and processed the control successfully |
| Windows |
5466 |
PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory cannot be reached, and will use the cached copy of the Active Directory IPsec policy instead |
| Windows |
5467 |
PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, and found no changes to the policy |
| Windows |
5468 |
PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, found changes to the policy, and applied those changes |
| Windows |
5471 |
PAStore Engine loaded local storage IPsec policy on the computer |
| Windows |
5472 |
PAStore Engine failed to load local storage IPsec policy on the computer |
| Windows |
5473 |
PAStore Engine loaded directory storage IPsec policy on the computer |
| Windows |
5474 |
PAStore Engine failed to load directory storage IPsec policy on the computer |
| Windows |
5477 |
PAStore Engine failed to add quick mode filter |
| Windows |
5478 |
IPsec Services has started successfully |
| Windows |
5479 |
IPsec Services has been shut down successfully |
| Windows |
5480 |
IPsec Services failed to get the complete list of network interfaces on the computer |
| Windows |
5483 |
IPsec Services failed to initialize RPC server. IPsec Services could not be started |
| Windows |
5484 |
IPsec Services has experienced a critical failure and has been shut down |
| Windows |
5485 |
IPsec Services failed to process some IPsec filters on a plug-and-play event for network interfaces |
| Windows |
5632 |
A request was made to authenticate to a wireless network |
| Windows |
5633 |
A request was made to authenticate to a wired network |
| Windows |
5712 |
A Remote Procedure Call (RPC) was attempted |
| Windows |
5888 |
An object in the COM+ Catalog was modified |
| Windows |
5889 |
An object was deleted from the COM+ Catalog |
| Windows |
5890 |
An object was added to the COM+ Catalog |
| Windows |
6144 |
Security policy in the group policy objects has been applied successfully |
| Windows |
6145 |
One or more errors occured while processing security policy in the group policy objects |
| Windows |
6272 |
Network Policy Server granted access to a user |
| Windows |
6273 |
Network Policy Server denied access to a user |
| Windows |
6274 |
Network Policy Server discarded the request for a user |
| Windows |
6275 |
Network Policy Server discarded the accounting request for a user |
| Windows |
6276 |
Network Policy Server quarantined a user |
| Windows |
6277 |
Network Policy Server granted access to a user but put it on probation because the host did not meet the defined health policy |
| Windows |
6278 |
Network Policy Server granted full access to a user because the host met the defined health policy |
| Windows |
6279 |
Network Policy Server locked the user account due to repeated failed authentication attempts |
| Windows |
6280 |
Network Policy Server unlocked the user account |
| Windows |
6281 |
Code Integrity determined that the page hashes of an image file are not valid… |
| Windows |
6400 |
BranchCache: Received an incorrectly formatted response while discovering availability of content. |
| Windows |
6401 |
BranchCache: Received invalid data from a peer. Data discarded. |
| Windows |
6402 |
BranchCache: The message to the hosted cache offering it data is incorrectly formatted. |
| Windows |
6403 |
BranchCache: The hosted cache sent an incorrectly formatted response to the client’s message to offer it data. |
| Windows |
6404 |
BranchCache: Hosted cache could not be authenticated using the provisioned SSL certificate. |
| Windows |
6405 |
BranchCache: %2 instance(s) of event id %1 occurred. |
| Windows |
6406 |
%1 registered to Windows Firewall to control filtering for the following: |
| Windows |
6407 |
%1 |
| Windows |
6408 |
Registered product %1 failed and Windows Firewall is now controlling the filtering for %2. |
| Windows |
6409 |
BranchCache: A service connection point object could not be parsed |
| Windows |
6410 |
Code integrity determined that a file does not meet the security requirements to load into a process. This could be due to the use of shared sections or other issues |
| Windows |
6416 |
A new external device was recognized by the system. |
| Windows |
6417 |
The FIPS mode crypto selftests succeeded |
| Windows |
6418 |
The FIPS mode crypto selftests failed |
| Windows |
6419 |
A request was made to disable a device |
| Windows |
6420 |
A device was disabled |
| Windows |
6421 |
A request was made to enable a device |
| Windows |
6422 |
A device was enabled |
| Windows |
6423 |
The installation of this device is forbidden by system policy |
| Windows |
6424 |
The installation of this device was allowed, after having previously been forbidden by policy |
| Windows |
8191 |
Highest System-Defined Audit Message Value |