| Windows |
1100 |
The event logging service has shut down |
| Windows |
1101 |
Audit events have been dropped by the transport. |
| Windows |
1102 |
The audit log was cleared |
| Windows |
1104 |
The security Log is now full |
| Windows |
1105 |
Event log automatic backup |
| Windows |
1108 |
The event logging service encountered an error |
| Windows |
4608 |
Windows is starting up |
| Windows |
4609 |
Windows is shutting down |
| Windows |
4610 |
An authentication package has been loaded by the Local Security Authority |
| Windows |
4611 |
A trusted logon process has been registered with the Local Security Authority |
| Windows |
4612 |
Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits. |
| Windows |
4614 |
A notification package has been loaded by the Security Account Manager. |
| Windows |
4615 |
Invalid use of LPC port |
| Windows |
4616 |
The system time was changed. |
| Windows |
4618 |
A monitored security event pattern has occurred |
| Windows |
4621 |
Administrator recovered system from CrashOnAuditFail |
| Windows |
4622 |
A security package has been loaded by the Local Security Authority. |
| Windows |
4624 |
An account was successfully logged on |
| Windows |
4625 |
An account failed to log on |
| Windows |
4626 |
User/Device claims information |
| Windows |
4627 |
Group membership information. |
| Windows |
4634 |
An account was logged off |
| Windows |
4646 |
IKE DoS-prevention mode started |
| Windows |
4647 |
User initiated logoff |
| Windows |
4648 |
A logon was attempted using explicit credentials |
| Windows |
4649 |
A replay attack was detected |
| Windows |
4650 |
An IPsec Main Mode security association was established |
| Windows |
4651 |
An IPsec Main Mode security association was established |
| Windows |
4652 |
An IPsec Main Mode negotiation failed |
| Windows |
4653 |
An IPsec Main Mode negotiation failed |
| Windows |
4654 |
An IPsec Quick Mode negotiation failed |
| Windows |
4655 |
An IPsec Main Mode security association ended |
| Windows |
4656 |
A handle to an object was requested |
| Windows |
4657 |
A registry value was modified |
| Windows |
4658 |
The handle to an object was closed |
| Windows |
4659 |
A handle to an object was requested with intent to delete |
| Windows |
4660 |
An object was deleted |
| Windows |
4661 |
A handle to an object was requested |
| Windows |
4662 |
An operation was performed on an object |
| Windows |
4663 |
An attempt was made to access an object |
| Windows |
4664 |
An attempt was made to create a hard link |
| Windows |
4665 |
An attempt was made to create an application client context. |
| Windows |
4666 |
An application attempted an operation |
| Windows |
4667 |
An application client context was deleted |
| Windows |
4668 |
An application was initialized |
| Windows |
4670 |
Permissions on an object were changed |
| Windows |
4671 |
An application attempted to access a blocked ordinal through the TBS |
| Windows |
4672 |
Special privileges assigned to new logon |
| Windows |
4673 |
A privileged service was called |
| Windows |
4674 |
An operation was attempted on a privileged object |
| Windows |
4675 |
SIDs were filtered |
| Windows |
4688 |
A new process has been created |
| Windows |
4689 |
A process has exited |
| Windows |
4690 |
An attempt was made to duplicate a handle to an object |
| Windows |
4691 |
Indirect access to an object was requested |
| Windows |
4692 |
Backup of data protection master key was attempted |
| Windows |
4693 |
Recovery of data protection master key was attempted |
| Windows |
4694 |
Protection of auditable protected data was attempted |
| Windows |
4695 |
Unprotection of auditable protected data was attempted |
| Windows |
4696 |
A primary token was assigned to process |
| Windows |
4697 |
A service was installed in the system |
| Windows |
4698 |
A scheduled task was created |
| Windows |
4699 |
A scheduled task was deleted |
| Windows |
4700 |
A scheduled task was enabled |
| Windows |
4701 |
A scheduled task was disabled |
| Windows |
4702 |
A scheduled task was updated |
| Windows |
4703 |
A token right was adjusted |
| Windows |
4704 |
A user right was assigned |
| Windows |
4705 |
A user right was removed |
| Windows |
4706 |
A new trust was created to a domain |
| Windows |
4707 |
A trust to a domain was removed |
| Windows |
4709 |
IPsec Services was started |
| Windows |
4710 |
IPsec Services was disabled |
| Windows |
4711 |
PAStore Engine (1%) |
| Windows |
4712 |
IPsec Services encountered a potentially serious failure |
| Windows |
4713 |
Kerberos policy was changed |
| Windows |
4714 |
Encrypted data recovery policy was changed |
| Windows |
4715 |
The audit policy (SACL) on an object was changed |
| Windows |
4716 |
Trusted domain information was modified |
| Windows |
4717 |
System security access was granted to an account |
| Windows |
4718 |
System security access was removed from an account |
| Windows |
4719 |
System audit policy was changed |
| Windows |
4720 |
A user account was created |
| Windows |
4722 |
A user account was enabled |
| Windows |
4723 |
An attempt was made to change an account’s password |
| Windows |
4724 |
An attempt was made to reset an accounts password |
| Windows |
4725 |
A user account was disabled |
| Windows |
4726 |
A user account was deleted |
| Windows |
4727 |
A security-enabled global group was created |
| Windows |
4728 |
A member was added to a security-enabled global group |
| Windows |
4729 |
A member was removed from a security-enabled global group |
| Windows |
4730 |
A security-enabled global group was deleted |
| Windows |
4731 |
A security-enabled local group was created |
| Windows |
4732 |
A member was added to a security-enabled local group |
| Windows |
4733 |
A member was removed from a security-enabled local group |
| Windows |
4734 |
A security-enabled local group was deleted |
| Windows |
4735 |
A security-enabled local group was changed |
| Windows |
4737 |
A security-enabled global group was changed |
| Windows |
4738 |
A user account was changed |
| Windows |
4739 |
Domain Policy was changed |
| Windows |
4740 |
A user account was locked out |
| Windows |
4741 |
A computer account was created |
| Windows |
4742 |
A computer account was changed |
| Windows |
4743 |
A computer account was deleted |
| Windows |
4744 |
A security-disabled local group was created |
| Windows |
4745 |
A security-disabled local group was changed |
| Windows |
4746 |
A member was added to a security-disabled local group |
| Windows |
4747 |
A member was removed from a security-disabled local group |
| Windows |
4748 |
A security-disabled local group was deleted |
| Windows |
4749 |
A security-disabled global group was created |
| Windows |
4750 |
A security-disabled global group was changed |
| Windows |
4751 |
A member was added to a security-disabled global group |
| Windows |
4752 |
A member was removed from a security-disabled global group |
| Windows |
4753 |
A security-disabled global group was deleted |
| Windows |
4754 |
A security-enabled universal group was created |
| Windows |
4755 |
A security-enabled universal group was changed |
| Windows |
4756 |
A member was added to a security-enabled universal group |
| Windows |
4757 |
A member was removed from a security-enabled universal group |
| Windows |
4758 |
A security-enabled universal group was deleted |
| Windows |
4759 |
A security-disabled universal group was created |
| Windows |
4760 |
A security-disabled universal group was changed |
| Windows |
4761 |
A member was added to a security-disabled universal group |
| Windows |
4762 |
A member was removed from a security-disabled universal group |
| Windows |
4763 |
A security-disabled universal group was deleted |
| Windows |
4764 |
A groups type was changed |
| Windows |
4765 |
SID History was added to an account |
| Windows |
4766 |
An attempt to add SID History to an account failed |
| Windows |
4767 |
A user account was unlocked |
| Windows |
4768 |
A Kerberos authentication ticket (TGT) was requested |
| Windows |
4769 |
A Kerberos service ticket was requested |
| Windows |
4770 |
A Kerberos service ticket was renewed |
| Windows |
4771 |
Kerberos pre-authentication failed |
| Windows |
4772 |
A Kerberos authentication ticket request failed |
| Windows |
4773 |
A Kerberos service ticket request failed |
| Windows |
4774 |
An account was mapped for logon |
| Windows |
4775 |
An account could not be mapped for logon |
| Windows |
4776 |
The domain controller attempted to validate the credentials for an account |
| Windows |
4777 |
The domain controller failed to validate the credentials for an account |
| Windows |
4778 |
A session was reconnected to a Window Station |
| Windows |
4779 |
A session was disconnected from a Window Station |
| Windows |
4780 |
The ACL was set on accounts which are members of administrators groups |
| Windows |
4781 |
The name of an account was changed |
| Windows |
4782 |
The password hash an account was accessed |
| Windows |
4783 |
A basic application group was created |
| Windows |
4784 |
A basic application group was changed |
| Windows |
4785 |
A member was added to a basic application group |
| Windows |
4786 |
A member was removed from a basic application group |
| Windows |
4787 |
A non-member was added to a basic application group |
| Windows |
4788 |
A non-member was removed from a basic application group.. |
| Windows |
4789 |
A basic application group was deleted |
| Windows |
4790 |
An LDAP query group was created |
| Windows |
4791 |
A basic application group was changed |
| Windows |
4792 |
An LDAP query group was deleted |
| Windows |
4793 |
The Password Policy Checking API was called |
| Windows |
4794 |
An attempt was made to set the Directory Services Restore Mode administrator password |
| Windows |
4797 |
An attempt was made to query the existence of a blank password for an account |
| Windows |
4798 |
A user’s local group membership was enumerated. |
| Windows |
4799 |
A security-enabled local group membership was enumerated |
| Windows |
4800 |
The workstation was locked |
| Windows |
4801 |
The workstation was unlocked |
| Windows |
4802 |
The screen saver was invoked |
| Windows |
4803 |
The screen saver was dismissed |
| Windows |
4816 |
RPC detected an integrity violation while decrypting an incoming message |
| Windows |
4817 |
Auditing settings on object were changed. |
| Windows |
4818 |
Proposed Central Access Policy does not grant the same access permissions as the current Central Access Policy |
| Windows |
4819 |
Central Access Policies on the machine have been changed |
| Windows |
4820 |
A Kerberos Ticket-granting-ticket (TGT) was denied because the device does not meet the access control restrictions |
| Windows |
4821 |
A Kerberos service ticket was denied because the user, device, or both does not meet the access control restrictions |
| Windows |
4822 |
NTLM authentication failed because the account was a member of the Protected User group |
| Windows |
4823 |
NTLM authentication failed because access control restrictions are required |
| Windows |
4824 |
Kerberos preauthentication by using DES or RC4 failed because the account was a member of the Protected User group |
| Windows |
4825 |
A user was denied the access to Remote Desktop. By default, users are allowed to connect only if they are members of the Remote Desktop Users group or Administrators group |
| Windows |
4826 |
Boot Configuration Data loaded |
| Windows |
4830 |
SID History was removed from an account |
| Windows |
4864 |
A namespace collision was detected |
| Windows |
4865 |
A trusted forest information entry was added |
| Windows |
4866 |
A trusted forest information entry was removed |
| Windows |
4867 |
A trusted forest information entry was modified |
| Windows |
4868 |
The certificate manager denied a pending certificate request |
| Windows |
4869 |
Certificate Services received a resubmitted certificate request |
| Windows |
4870 |
Certificate Services revoked a certificate |
| Windows |
4871 |
Certificate Services received a request to publish the certificate revocation list (CRL) |
| Windows |
4872 |
Certificate Services published the certificate revocation list (CRL) |
| Windows |
4873 |
A certificate request extension changed |
| Windows |
4874 |
One or more certificate request attributes changed. |
| Windows |
4875 |
Certificate Services received a request to shut down |
| Windows |
4876 |
Certificate Services backup started |
| Windows |
4877 |
Certificate Services backup completed |
| Windows |
4878 |
Certificate Services restore started |
| Windows |
4879 |
Certificate Services restore completed |
| Windows |
4880 |
Certificate Services started |
| Windows |
4881 |
Certificate Services stopped |
| Windows |
4882 |
The security permissions for Certificate Services changed |
| Windows |
4883 |
Certificate Services retrieved an archived key |
| Windows |
4884 |
Certificate Services imported a certificate into its database |
| Windows |
4885 |
The audit filter for Certificate Services changed |
| Windows |
4886 |
Certificate Services received a certificate request |
| Windows |
4887 |
Certificate Services approved a certificate request and issued a certificate |
| Windows |
4888 |
Certificate Services denied a certificate request |
| Windows |
4889 |
Certificate Services set the status of a certificate request to pending |
| Windows |
4890 |
The certificate manager settings for Certificate Services changed. |
| Windows |
4891 |
A configuration entry changed in Certificate Services |
| Windows |
4892 |
A property of Certificate Services changed |
| Windows |
4893 |
Certificate Services archived a key |
| Windows |
4894 |
Certificate Services imported and archived a key |
| Windows |
4895 |
Certificate Services published the CA certificate to Active Directory Domain Services |
| Windows |
4896 |
One or more rows have been deleted from the certificate database |
| Windows |
4897 |
Role separation enabled |
| Windows |
4898 |
Certificate Services loaded a template |
| Windows |
4899 |
A Certificate Services template was updated |
| Windows |
4900 |
Certificate Services template security was updated |
| Windows |
4902 |
The Per-user audit policy table was created |
| Windows |
4904 |
An attempt was made to register a security event source |
| Windows |
4905 |
An attempt was made to unregister a security event source |
| Windows |
4906 |
The CrashOnAuditFail value has changed |
| Windows |
4907 |
Auditing settings on object were changed |
| Windows |
4908 |
Special Groups Logon table modified |
| Windows |
4909 |
The local policy settings for the TBS were changed |
| Windows |
4910 |
The group policy settings for the TBS were changed |
| Windows |
4911 |
Resource attributes of the object were changed |
| Windows |
4912 |
Per User Audit Policy was changed |
| Windows |
4913 |
Central Access Policy on the object was changed |
| Windows |
4928 |
An Active Directory replica source naming context was established |
| Windows |
4929 |
An Active Directory replica source naming context was removed |
| Windows |
4930 |
An Active Directory replica source naming context was modified |
| Windows |
4931 |
An Active Directory replica destination naming context was modified |
| Windows |
4932 |
Synchronization of a replica of an Active Directory naming context has begun |
| Windows |
4933 |
Synchronization of a replica of an Active Directory naming context has ended |
| Windows |
4934 |
Attributes of an Active Directory object were replicated |
| Windows |
4935 |
Replication failure begins |
| Windows |
4936 |
Replication failure ends |
| Windows |
4937 |
A lingering object was removed from a replica |
| Windows |
4944 |
The following policy was active when the Windows Firewall started |
| Windows |
4945 |
A rule was listed when the Windows Firewall started |
| Windows |
4946 |
A change has been made to Windows Firewall exception list. A rule was added |
| Windows |
4947 |
A change has been made to Windows Firewall exception list. A rule was modified |
| Windows |
4948 |
A change has been made to Windows Firewall exception list. A rule was deleted |
| Windows |
4949 |
Windows Firewall settings were restored to the default values |
| Windows |
4950 |
A Windows Firewall setting has changed |
| Windows |
4951 |
A rule has been ignored because its major version number was not recognized by Windows Firewall |
| Windows |
4952 |
Parts of a rule have been ignored because its minor version number was not recognized by Windows Firewall |
| Windows |
4953 |
A rule has been ignored by Windows Firewall because it could not parse the rule |
| Windows |
4954 |
Windows Firewall Group Policy settings has changed. The new settings have been applied |
| Windows |
4956 |
Windows Firewall has changed the active profile |
| Windows |
4957 |
Windows Firewall did not apply the following rule |
| Windows |
4958 |
Windows Firewall did not apply the following rule because the rule referred to items not configured on this computer |
| Windows |
4960 |
IPsec dropped an inbound packet that failed an integrity check |
| Windows |
4961 |
IPsec dropped an inbound packet that failed a replay check |
| Windows |
4962 |
IPsec dropped an inbound packet that failed a replay check |
| Windows |
4963 |
IPsec dropped an inbound clear text packet that should have been secured |
| Windows |
4964 |
Special groups have been assigned to a new logon |
| Windows |
4965 |
IPsec received a packet from a remote computer with an incorrect Security Parameter Index (SPI). |
| Windows |
4976 |
During Main Mode negotiation, IPsec received an invalid negotiation packet. |
| Windows |
4977 |
During Quick Mode negotiation, IPsec received an invalid negotiation packet. |
| Windows |
4978 |
During Extended Mode negotiation, IPsec received an invalid negotiation packet. |
| Windows |
4979 |
IPsec Main Mode and Extended Mode security associations were established. |
| Windows |
4980 |
IPsec Main Mode and Extended Mode security associations were established |
| Windows |
4981 |
IPsec Main Mode and Extended Mode security associations were established |
| Windows |
4982 |
IPsec Main Mode and Extended Mode security associations were established |
| Windows |
4983 |
An IPsec Extended Mode negotiation failed |
| Windows |
4984 |
An IPsec Extended Mode negotiation failed |
| Windows |
4985 |
The state of a transaction has changed |
| Windows |
5024 |
The Windows Firewall Service has started successfully |
| Windows |
5025 |
The Windows Firewall Service has been stopped |
| Windows |
5027 |
The Windows Firewall Service was unable to retrieve the security policy from the local storage |
| Windows |
5028 |
The Windows Firewall Service was unable to parse the new security policy. |
| Windows |
5029 |
The Windows Firewall Service failed to initialize the driver |
| Windows |
5030 |
The Windows Firewall Service failed to start |
| Windows |
5031 |
The Windows Firewall Service blocked an application from accepting incoming connections on the network. |
| Windows |
5032 |
Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network |
| Windows |
5033 |
The Windows Firewall Driver has started successfully |
| Windows |
5034 |
The Windows Firewall Driver has been stopped |
| Windows |
5035 |
The Windows Firewall Driver failed to start |
| Windows |
5037 |
The Windows Firewall Driver detected critical runtime error. Terminating |
| Windows |
5038 |
Code integrity determined that the image hash of a file is not valid |
| Windows |
5039 |
A registry key was virtualized. |
| Windows |
5040 |
A change has been made to IPsec settings. An Authentication Set was added. |
| Windows |
5041 |
A change has been made to IPsec settings. An Authentication Set was modified |
| Windows |
5042 |
A change has been made to IPsec settings. An Authentication Set was deleted |
| Windows |
5043 |
A change has been made to IPsec settings. A Connection Security Rule was added |
| Windows |
5044 |
A change has been made to IPsec settings. A Connection Security Rule was modified |
| Windows |
5045 |
A change has been made to IPsec settings. A Connection Security Rule was deleted |
| Windows |
5046 |
A change has been made to IPsec settings. A Crypto Set was added |
| Windows |
5047 |
A change has been made to IPsec settings. A Crypto Set was modified |
| Windows |
5048 |
A change has been made to IPsec settings. A Crypto Set was deleted |
| Windows |
5049 |
An IPsec Security Association was deleted |
| Windows |
5050 |
An attempt to programmatically disable the Windows Firewall using a call to INetFwProfile.FirewallEnabled(FALSE |
| Windows |
5051 |
A file was virtualized |
| Windows |
5056 |
A cryptographic self test was performed |
| Windows |
5057 |
A cryptographic primitive operation failed |
| Windows |
5058 |
Key file operation |
| Windows |
5059 |
Key migration operation |
| Windows |
5060 |
Verification operation failed |
| Windows |
5061 |
Cryptographic operation |
| Windows |
5062 |
A kernel-mode cryptographic self test was performed |
| Windows |
5063 |
A cryptographic provider operation was attempted |
| Windows |
5064 |
A cryptographic context operation was attempted |
| Windows |
5065 |
A cryptographic context modification was attempted |
| Windows |
5066 |
A cryptographic function operation was attempted |
| Windows |
5067 |
A cryptographic function modification was attempted |
| Windows |
5068 |
A cryptographic function provider operation was attempted |
| Windows |
5069 |
A cryptographic function property operation was attempted |
| Windows |
5070 |
A cryptographic function property operation was attempted |
| Windows |
5071 |
Key access denied by Microsoft key distribution service |
| Windows |
5120 |
OCSP Responder Service Started |
| Windows |
5121 |
OCSP Responder Service Stopped |
| Windows |
5122 |
A Configuration entry changed in the OCSP Responder Service |
| Windows |
5123 |
A configuration entry changed in the OCSP Responder Service |
| Windows |
5124 |
A security setting was updated on OCSP Responder Service |
| Windows |
5125 |
A request was submitted to OCSP Responder Service |
| Windows |
5126 |
Signing Certificate was automatically updated by the OCSP Responder Service |
| Windows |
5127 |
The OCSP Revocation Provider successfully updated the revocation information |
| Windows |
5136 |
A directory service object was modified |
| Windows |
5137 |
A directory service object was created |
| Windows |
5138 |
A directory service object was undeleted |
| Windows |
5139 |
A directory service object was moved |
| Windows |
5140 |
A network share object was accessed |
| Windows |
5141 |
A directory service object was deleted |
| Windows |
5142 |
A network share object was added. |
| Windows |
5143 |
A network share object was modified |
| Windows |
5144 |
A network share object was deleted. |
| Windows |
5145 |
A network share object was checked to see whether client can be granted desired access |
| Windows |
5146 |
The Windows Filtering Platform has blocked a packet |
| Windows |
5147 |
A more restrictive Windows Filtering Platform filter has blocked a packet |
| Windows |
5148 |
The Windows Filtering Platform has detected a DoS attack and entered a defensive mode; packets associated with this attack will be discarded. |
| Windows |
5149 |
The DoS attack has subsided and normal processing is being resumed. |
| Windows |
5150 |
The Windows Filtering Platform has blocked a packet. |
| Windows |
5151 |
A more restrictive Windows Filtering Platform filter has blocked a packet. |
| Windows |
5152 |
The Windows Filtering Platform blocked a packet |
| Windows |
5153 |
A more restrictive Windows Filtering Platform filter has blocked a packet |
| Windows |
5154 |
The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections |
| Windows |
5155 |
The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections |
| Windows |
5156 |
The Windows Filtering Platform has allowed a connection |
| Windows |
5157 |
The Windows Filtering Platform has blocked a connection |
| Windows |
5158 |
The Windows Filtering Platform has permitted a bind to a local port |
| Windows |
5159 |
The Windows Filtering Platform has blocked a bind to a local port |
| Windows |
5168 |
Spn check for SMB/SMB2 fails. |
| Windows |
5169 |
A directory service object was modified |
| Windows |
5170 |
A directory service object was modified during a background cleanup task |
| Windows |
5376 |
Credential Manager credentials were backed up |
| Windows |
5377 |
Credential Manager credentials were restored from a backup |
| Windows |
5378 |
The requested credentials delegation was disallowed by policy |
| Windows |
5379 |
Credential Manager credentials were read |
| Windows |
5380 |
Vault Find Credential |
| Windows |
5381 |
Vault credentials were read |
| Windows |
5382 |
Vault credentials were read |
| Windows |
5440 |
The following callout was present when the Windows Filtering Platform Base Filtering Engine started |
| Windows |
5441 |
The following filter was present when the Windows Filtering Platform Base Filtering Engine started |
| Windows |
5442 |
The following provider was present when the Windows Filtering Platform Base Filtering Engine started |
| Windows |
5443 |
The following provider context was present when the Windows Filtering Platform Base Filtering Engine started |
| Windows |
5444 |
The following sub-layer was present when the Windows Filtering Platform Base Filtering Engine started |
| Windows |
5446 |
A Windows Filtering Platform callout has been changed |
| Windows |
5447 |
A Windows Filtering Platform filter has been changed |
| Windows |
5448 |
A Windows Filtering Platform provider has been changed |
| Windows |
5449 |
A Windows Filtering Platform provider context has been changed |
| Windows |
5450 |
A Windows Filtering Platform sub-layer has been changed |
| Windows |
5451 |
An IPsec Quick Mode security association was established |
| Windows |
5452 |
An IPsec Quick Mode security association ended |
| Windows |
5453 |
An IPsec negotiation with a remote computer failed because the IKE and AuthIP IPsec Keying Modules (IKEEXT) service is not started |
| Windows |
5456 |
PAStore Engine applied Active Directory storage IPsec policy on the computer |
| Windows |
5457 |
PAStore Engine failed to apply Active Directory storage IPsec policy on the computer |
| Windows |
5458 |
PAStore Engine applied locally cached copy of Active Directory storage IPsec policy on the computer |
| Windows |
5459 |
PAStore Engine failed to apply locally cached copy of Active Directory storage IPsec policy on the computer |
| Windows |
5460 |
PAStore Engine applied local registry storage IPsec policy on the computer |
| Windows |
5461 |
PAStore Engine failed to apply local registry storage IPsec policy on the computer |
| Windows |
5462 |
PAStore Engine failed to apply some rules of the active IPsec policy on the computer |
| Windows |
5463 |
PAStore Engine polled for changes to the active IPsec policy and detected no changes |
| Windows |
5464 |
PAStore Engine polled for changes to the active IPsec policy, detected changes, and applied them to IPsec Services |
| Windows |
5465 |
PAStore Engine received a control for forced reloading of IPsec policy and processed the control successfully |
| Windows |
5466 |
PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory cannot be reached, and will use the cached copy of the Active Directory IPsec policy instead |
| Windows |
5467 |
PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, and found no changes to the policy |
| Windows |
5468 |
PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, found changes to the policy, and applied those changes |
| Windows |
5471 |
PAStore Engine loaded local storage IPsec policy on the computer |
| Windows |
5472 |
PAStore Engine failed to load local storage IPsec policy on the computer |
| Windows |
5473 |
PAStore Engine loaded directory storage IPsec policy on the computer |
| Windows |
5474 |
PAStore Engine failed to load directory storage IPsec policy on the computer |
| Windows |
5477 |
PAStore Engine failed to add quick mode filter |
| Windows |
5478 |
IPsec Services has started successfully |
| Windows |
5479 |
IPsec Services has been shut down successfully |
| Windows |
5480 |
IPsec Services failed to get the complete list of network interfaces on the computer |
| Windows |
5483 |
IPsec Services failed to initialize RPC server. IPsec Services could not be started |
| Windows |
5484 |
IPsec Services has experienced a critical failure and has been shut down |
| Windows |
5485 |
IPsec Services failed to process some IPsec filters on a plug-and-play event for network interfaces |
| Windows |
5632 |
A request was made to authenticate to a wireless network |
| Windows |
5633 |
A request was made to authenticate to a wired network |
| Windows |
5712 |
A Remote Procedure Call (RPC) was attempted |
| Windows |
5888 |
An object in the COM+ Catalog was modified |
| Windows |
5889 |
An object was deleted from the COM+ Catalog |
| Windows |
5890 |
An object was added to the COM+ Catalog |
| Windows |
6144 |
Security policy in the group policy objects has been applied successfully |
| Windows |
6145 |
One or more errors occured while processing security policy in the group policy objects |
| Windows |
6272 |
Network Policy Server granted access to a user |
| Windows |
6273 |
Network Policy Server denied access to a user |
| Windows |
6274 |
Network Policy Server discarded the request for a user |
| Windows |
6275 |
Network Policy Server discarded the accounting request for a user |
| Windows |
6276 |
Network Policy Server quarantined a user |
| Windows |
6277 |
Network Policy Server granted access to a user but put it on probation because the host did not meet the defined health policy |
| Windows |
6278 |
Network Policy Server granted full access to a user because the host met the defined health policy |
| Windows |
6279 |
Network Policy Server locked the user account due to repeated failed authentication attempts |
| Windows |
6280 |
Network Policy Server unlocked the user account |
| Windows |
6281 |
Code Integrity determined that the page hashes of an image file are not valid… |
| Windows |
6400 |
BranchCache: Received an incorrectly formatted response while discovering availability of content. |
| Windows |
6401 |
BranchCache: Received invalid data from a peer. Data discarded. |
| Windows |
6402 |
BranchCache: The message to the hosted cache offering it data is incorrectly formatted. |
| Windows |
6403 |
BranchCache: The hosted cache sent an incorrectly formatted response to the client’s message to offer it data. |
| Windows |
6404 |
BranchCache: Hosted cache could not be authenticated using the provisioned SSL certificate. |
| Windows |
6405 |
BranchCache: %2 instance(s) of event id %1 occurred. |
| Windows |
6406 |
%1 registered to Windows Firewall to control filtering for the following: |
| Windows |
6407 |
%1 |
| Windows |
6408 |
Registered product %1 failed and Windows Firewall is now controlling the filtering for %2. |
| Windows |
6409 |
BranchCache: A service connection point object could not be parsed |
| Windows |
6410 |
Code integrity determined that a file does not meet the security requirements to load into a process. This could be due to the use of shared sections or other issues |
| Windows |
6416 |
A new external device was recognized by the system. |
| Windows |
6417 |
The FIPS mode crypto selftests succeeded |
| Windows |
6418 |
The FIPS mode crypto selftests failed |
| Windows |
6419 |
A request was made to disable a device |
| Windows |
6420 |
A device was disabled |
| Windows |
6421 |
A request was made to enable a device |
| Windows |
6422 |
A device was enabled |
| Windows |
6423 |
The installation of this device is forbidden by system policy |
| Windows |
6424 |
The installation of this device was allowed, after having previously been forbidden by policy |
| Windows |
8191 |
Highest System-Defined Audit Message Value |
1100
The event logging service has shut down
1101
Audit events have been dropped by the transport.
1102
The audit log was cleared
1104
The security Log is now full
1105
Event log automatic backup
1108
The event logging service encountered an error
4608
Windows is starting up
4609
Windows is shutting down
4610
An authentication package has been loaded by the Local Security Authority
4611
A trusted logon process has been registered with the Local Security Authority
4612
Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits.
4614
A notification package has been loaded by the Security Account Manager.
4615
Invalid use of LPC port
4616
The system time was changed.
4618
A monitored security event pattern has occurred
4621
Administrator recovered system from CrashOnAuditFail
4622
A security package has been loaded by the Local Security Authority.
4624
An account was successfully logged on
4625
An account failed to log on
4626
User/Device claims information
4627
Group membership information.
4634
An account was logged off
4646
IKE DoS-prevention mode started
4647
User initiated logoff
4648
A logon was attempted using explicit credentials
4649
A replay attack was detected
4650
An IPsec Main Mode security association was established
4651
An IPsec Main Mode security association was established
4652
An IPsec Main Mode negotiation failed
4653
An IPsec Main Mode negotiation failed
4654
An IPsec Quick Mode negotiation failed
4655
An IPsec Main Mode security association ended
4656
A handle to an object was requested
4657
A registry value was modified
4658
The handle to an object was closed
4659
A handle to an object was requested with intent to delete
4660
An object was deleted
4661
A handle to an object was requested
4662
An operation was performed on an object
4663
An attempt was made to access an object
4664
An attempt was made to create a hard link
4665
An attempt was made to create an application client context.
4666
An application attempted an operation
4667
An application client context was deleted
4668
An application was initialized
4670
Permissions on an object were changed
4671
An application attempted to access a blocked ordinal through the TBS
4672
Special privileges assigned to new logon
4673
A privileged service was called
4674
An operation was attempted on a privileged object
4675
SIDs were filtered
4688
A new process has been created
4689
A process has exited
4690
An attempt was made to duplicate a handle to an object
4691
Indirect access to an object was requested
4692
Backup of data protection master key was attempted
4693
Recovery of data protection master key was attempted
4694
Protection of auditable protected data was attempted
4695
Unprotection of auditable protected data was attempted
4696
A primary token was assigned to process
4697
A service was installed in the system
4698
A scheduled task was created
4699
A scheduled task was deleted
4700
A scheduled task was enabled
4701
A scheduled task was disabled
4702
A scheduled task was updated
4703
A token right was adjusted
4704
A user right was assigned
4705
A user right was removed
4706
A new trust was created to a domain
4707
A trust to a domain was removed
4709
IPsec Services was started
4710
IPsec Services was disabled
4711
PAStore Engine (1%)
4712
IPsec Services encountered a potentially serious failure
4713
Kerberos policy was changed
4714
Encrypted data recovery policy was changed
4715
The audit policy (SACL) on an object was changed
4716
Trusted domain information was modified
4717
System security access was granted to an account
4718
System security access was removed from an account
4719
System audit policy was changed
4720
A user account was created
4722
A user account was enabled
4723
An attempt was made to change an account’s password
4724
An attempt was made to reset an accounts password
4725
A user account was disabled
4726
A user account was deleted
4727
A security-enabled global group was created
4728
A member was added to a security-enabled global group
4729
A member was removed from a security-enabled global group
4730
A security-enabled global group was deleted
4731
A security-enabled local group was created
4732
A member was added to a security-enabled local group
4733
A member was removed from a security-enabled local group
4734
A security-enabled local group was deleted
4735
A security-enabled local group was changed
4737
A security-enabled global group was changed
4738
A user account was changed
4739
Domain Policy was changed
4740
A user account was locked out
4741
A computer account was created
4742
A computer account was changed
4743
A computer account was deleted
4744
A security-disabled local group was created
4745
A security-disabled local group was changed
4746
A member was added to a security-disabled local group
4747
A member was removed from a security-disabled local group
4748
A security-disabled local group was deleted
4749
A security-disabled global group was created
4750
A security-disabled global group was changed
4751
A member was added to a security-disabled global group
4752
A member was removed from a security-disabled global group
4753
A security-disabled global group was deleted
4754
A security-enabled universal group was created
4755
A security-enabled universal group was changed
4756
A member was added to a security-enabled universal group
4757
A member was removed from a security-enabled universal group
4758
A security-enabled universal group was deleted
4759
A security-disabled universal group was created
4760
A security-disabled universal group was changed
4761
A member was added to a security-disabled universal group
4762
A member was removed from a security-disabled universal group
4763
A security-disabled universal group was deleted
4764
A groups type was changed
4765
SID History was added to an account
4766
An attempt to add SID History to an account failed
4767
A user account was unlocked
4768
A Kerberos authentication ticket (TGT) was requested
4769
A Kerberos service ticket was requested
4770
A Kerberos service ticket was renewed
4771
Kerberos pre-authentication failed
4772
A Kerberos authentication ticket request failed
4773
A Kerberos service ticket request failed
4774
An account was mapped for logon
4775
An account could not be mapped for logon
4776
The domain controller attempted to validate the credentials for an account
4777
The domain controller failed to validate the credentials for an account
4778
A session was reconnected to a Window Station
4779
A session was disconnected from a Window Station
4780
The ACL was set on accounts which are members of administrators groups
4781
The name of an account was changed
4782
The password hash an account was accessed
4783
A basic application group was created
4784
A basic application group was changed
4785
A member was added to a basic application group
4786
A member was removed from a basic application group
4787
A non-member was added to a basic application group
4788
A non-member was removed from a basic application group..
4789
A basic application group was deleted
4790
An LDAP query group was created
4791
A basic application group was changed
4792
An LDAP query group was deleted
4793
The Password Policy Checking API was called
4794
An attempt was made to set the Directory Services Restore Mode administrator password
4797
An attempt was made to query the existence of a blank password for an account
4798
A user’s local group membership was enumerated.
4799
A security-enabled local group membership was enumerated
4800
The workstation was locked
4801
The workstation was unlocked
4802
The screen saver was invoked
4803
The screen saver was dismissed
4816
RPC detected an integrity violation while decrypting an incoming message
4817
Auditing settings on object were changed.
4818
Proposed Central Access Policy does not grant the same access permissions as the current Central Access Policy
4819
Central Access Policies on the machine have been changed
4820
A Kerberos Ticket-granting-ticket (TGT) was denied because the device does not meet the access control restrictions
4821
A Kerberos service ticket was denied because the user, device, or both does not meet the access control restrictions
4822
NTLM authentication failed because the account was a member of the Protected User group
4823
NTLM authentication failed because access control restrictions are required
4824
Kerberos preauthentication by using DES or RC4 failed because the account was a member of the Protected User group
4825
A user was denied the access to Remote Desktop. By default, users are allowed to connect only if they are members of the Remote Desktop Users group or Administrators group
4826
Boot Configuration Data loaded
4830
SID History was removed from an account
4864
A namespace collision was detected
4865
A trusted forest information entry was added
4866
A trusted forest information entry was removed
4867
A trusted forest information entry was modified
4868
The certificate manager denied a pending certificate request
4869
Certificate Services received a resubmitted certificate request
4870
Certificate Services revoked a certificate
4871
Certificate Services received a request to publish the certificate revocation list (CRL)
4872
Certificate Services published the certificate revocation list (CRL)
4873
A certificate request extension changed
4874
One or more certificate request attributes changed.
4875
Certificate Services received a request to shut down
4876
Certificate Services backup started
4877
Certificate Services backup completed
4878
Certificate Services restore started
4879
Certificate Services restore completed
4880
Certificate Services started
4881
Certificate Services stopped
4882
The security permissions for Certificate Services changed
4883
Certificate Services retrieved an archived key
4884
Certificate Services imported a certificate into its database
4885
The audit filter for Certificate Services changed
4886
Certificate Services received a certificate request
4887
Certificate Services approved a certificate request and issued a certificate
4888
Certificate Services denied a certificate request
4889
Certificate Services set the status of a certificate request to pending
4890
The certificate manager settings for Certificate Services changed.
4891
A configuration entry changed in Certificate Services
4892
A property of Certificate Services changed
4893
Certificate Services archived a key
4894
Certificate Services imported and archived a key
4895
Certificate Services published the CA certificate to Active Directory Domain Services
4896
One or more rows have been deleted from the certificate database
4897
Role separation enabled
4898
Certificate Services loaded a template
4899
A Certificate Services template was updated
4900
Certificate Services template security was updated
4902
The Per-user audit policy table was created
4904
An attempt was made to register a security event source
4905
An attempt was made to unregister a security event source
4906
The CrashOnAuditFail value has changed
4907
Auditing settings on object were changed
4908
Special Groups Logon table modified
4909
The local policy settings for the TBS were changed
4910
The group policy settings for the TBS were changed
4911
Resource attributes of the object were changed
4912
Per User Audit Policy was changed
4913
Central Access Policy on the object was changed
4928
An Active Directory replica source naming context was established
4929
An Active Directory replica source naming context was removed
4930
An Active Directory replica source naming context was modified
4931
An Active Directory replica destination naming context was modified
4932
Synchronization of a replica of an Active Directory naming context has begun
4933
Synchronization of a replica of an Active Directory naming context has ended
4934
Attributes of an Active Directory object were replicated
4935
Replication failure begins
4936
Replication failure ends
4937
A lingering object was removed from a replica
4944
The following policy was active when the Windows Firewall started
4945
A rule was listed when the Windows Firewall started
4946
A change has been made to Windows Firewall exception list. A rule was added
4947
A change has been made to Windows Firewall exception list. A rule was modified
4948
A change has been made to Windows Firewall exception list. A rule was deleted
4949
Windows Firewall settings were restored to the default values
4950
A Windows Firewall setting has changed
4951
A rule has been ignored because its major version number was not recognized by Windows Firewall
4952
Parts of a rule have been ignored because its minor version number was not recognized by Windows Firewall
4953
A rule has been ignored by Windows Firewall because it could not parse the rule
4954
Windows Firewall Group Policy settings has changed. The new settings have been applied
4956
Windows Firewall has changed the active profile
4957
Windows Firewall did not apply the following rule
4958
Windows Firewall did not apply the following rule because the rule referred to items not configured on this computer
4960
IPsec dropped an inbound packet that failed an integrity check
4961
IPsec dropped an inbound packet that failed a replay check
4962
IPsec dropped an inbound packet that failed a replay check
4963
IPsec dropped an inbound clear text packet that should have been secured
4964
Special groups have been assigned to a new logon
4965
IPsec received a packet from a remote computer with an incorrect Security Parameter Index (SPI).
4976
During Main Mode negotiation, IPsec received an invalid negotiation packet.
4977
During Quick Mode negotiation, IPsec received an invalid negotiation packet.
4978
During Extended Mode negotiation, IPsec received an invalid negotiation packet.
4979
IPsec Main Mode and Extended Mode security associations were established.
4980
IPsec Main Mode and Extended Mode security associations were established
4981
IPsec Main Mode and Extended Mode security associations were established
4982
IPsec Main Mode and Extended Mode security associations were established
4983
An IPsec Extended Mode negotiation failed
4984
An IPsec Extended Mode negotiation failed
4985
The state of a transaction has changed
5024
The Windows Firewall Service has started successfully
5025
The Windows Firewall Service has been stopped
5027
The Windows Firewall Service was unable to retrieve the security policy from the local storage
5028
The Windows Firewall Service was unable to parse the new security policy.
5029
The Windows Firewall Service failed to initialize the driver
5030
The Windows Firewall Service failed to start
5031
The Windows Firewall Service blocked an application from accepting incoming connections on the network.
5032
Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network
5033
The Windows Firewall Driver has started successfully
5034
The Windows Firewall Driver has been stopped
5035
The Windows Firewall Driver failed to start
5037
The Windows Firewall Driver detected critical runtime error. Terminating
5038
Code integrity determined that the image hash of a file is not valid
5039
A registry key was virtualized.
5040
A change has been made to IPsec settings. An Authentication Set was added.
5041
A change has been made to IPsec settings. An Authentication Set was modified
5042
A change has been made to IPsec settings. An Authentication Set was deleted
5043
A change has been made to IPsec settings. A Connection Security Rule was added
5044
A change has been made to IPsec settings. A Connection Security Rule was modified
5045
A change has been made to IPsec settings. A Connection Security Rule was deleted
5046
A change has been made to IPsec settings. A Crypto Set was added
5047
A change has been made to IPsec settings. A Crypto Set was modified
5048
A change has been made to IPsec settings. A Crypto Set was deleted
5049
An IPsec Security Association was deleted
5050
An attempt to programmatically disable the Windows Firewall using a call to INetFwProfile.FirewallEnabled(FALSE
5051
A file was virtualized
5056
A cryptographic self test was performed
5057
A cryptographic primitive operation failed
5058
Key file operation
5059
Key migration operation
5060
Verification operation failed
5061
Cryptographic operation
5062
A kernel-mode cryptographic self test was performed
5063
A cryptographic provider operation was attempted
5064
A cryptographic context operation was attempted
5065
A cryptographic context modification was attempted
5066
A cryptographic function operation was attempted
5067
A cryptographic function modification was attempted
5068
A cryptographic function provider operation was attempted
5069
A cryptographic function property operation was attempted
5070
A cryptographic function property operation was attempted
5071
Key access denied by Microsoft key distribution service
5120
OCSP Responder Service Started
5121
OCSP Responder Service Stopped
5122
A Configuration entry changed in the OCSP Responder Service
5123
A configuration entry changed in the OCSP Responder Service
5124
A security setting was updated on OCSP Responder Service
5125
A request was submitted to OCSP Responder Service
5126
Signing Certificate was automatically updated by the OCSP Responder Service
5127
The OCSP Revocation Provider successfully updated the revocation information
5136
A directory service object was modified
5137
A directory service object was created
5138
A directory service object was undeleted
5139
A directory service object was moved
5140
A network share object was accessed
5141
A directory service object was deleted
5142
A network share object was added.
5143
A network share object was modified
5144
A network share object was deleted.
5145
A network share object was checked to see whether client can be granted desired access
5146
The Windows Filtering Platform has blocked a packet
5147
A more restrictive Windows Filtering Platform filter has blocked a packet
5148
The Windows Filtering Platform has detected a DoS attack and entered a defensive mode; packets associated with this attack will be discarded.
5149
The DoS attack has subsided and normal processing is being resumed.
5150
The Windows Filtering Platform has blocked a packet.
5151
A more restrictive Windows Filtering Platform filter has blocked a packet.
5152
The Windows Filtering Platform blocked a packet
5153
A more restrictive Windows Filtering Platform filter has blocked a packet
5154
The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections
5155
The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections
5156
The Windows Filtering Platform has allowed a connection
5157
The Windows Filtering Platform has blocked a connection
5158
The Windows Filtering Platform has permitted a bind to a local port
5159
The Windows Filtering Platform has blocked a bind to a local port
5168
Spn check for SMB/SMB2 fails.
5169
A directory service object was modified
5170
A directory service object was modified during a background cleanup task
5376
Credential Manager credentials were backed up
5377
Credential Manager credentials were restored from a backup
5378
The requested credentials delegation was disallowed by policy
5379
Credential Manager credentials were read
5380
Vault Find Credential
5381
Vault credentials were read
5382
Vault credentials were read
5440
The following callout was present when the Windows Filtering Platform Base Filtering Engine started
5441
The following filter was present when the Windows Filtering Platform Base Filtering Engine started
5442
The following provider was present when the Windows Filtering Platform Base Filtering Engine started
5443
The following provider context was present when the Windows Filtering Platform Base Filtering Engine started
5444
The following sub-layer was present when the Windows Filtering Platform Base Filtering Engine started
5446
A Windows Filtering Platform callout has been changed
5447
A Windows Filtering Platform filter has been changed
5448
A Windows Filtering Platform provider has been changed
5449
A Windows Filtering Platform provider context has been changed
5450
A Windows Filtering Platform sub-layer has been changed
5451
An IPsec Quick Mode security association was established
5452
An IPsec Quick Mode security association ended
5453
An IPsec negotiation with a remote computer failed because the IKE and AuthIP IPsec Keying Modules (IKEEXT) service is not started
5456
PAStore Engine applied Active Directory storage IPsec policy on the computer
5457
PAStore Engine failed to apply Active Directory storage IPsec policy on the computer
5458
PAStore Engine applied locally cached copy of Active Directory storage IPsec policy on the computer
5459
PAStore Engine failed to apply locally cached copy of Active Directory storage IPsec policy on the computer
5460
PAStore Engine applied local registry storage IPsec policy on the computer
5461
PAStore Engine failed to apply local registry storage IPsec policy on the computer
5462
PAStore Engine failed to apply some rules of the active IPsec policy on the computer
5463
PAStore Engine polled for changes to the active IPsec policy and detected no changes
5464
PAStore Engine polled for changes to the active IPsec policy, detected changes, and applied them to IPsec Services
5465
PAStore Engine received a control for forced reloading of IPsec policy and processed the control successfully
5466
PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory cannot be reached, and will use the cached copy of the Active Directory IPsec policy instead
5467
PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, and found no changes to the policy
5468
PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, found changes to the policy, and applied those changes
5471
PAStore Engine loaded local storage IPsec policy on the computer
5472
PAStore Engine failed to load local storage IPsec policy on the computer
5473
PAStore Engine loaded directory storage IPsec policy on the computer
5474
PAStore Engine failed to load directory storage IPsec policy on the computer
5477
PAStore Engine failed to add quick mode filter
5478
IPsec Services has started successfully
5479
IPsec Services has been shut down successfully
5480
IPsec Services failed to get the complete list of network interfaces on the computer
5483
IPsec Services failed to initialize RPC server. IPsec Services could not be started
5484
IPsec Services has experienced a critical failure and has been shut down
5485
IPsec Services failed to process some IPsec filters on a plug-and-play event for network interfaces
5632
A request was made to authenticate to a wireless network
5633
A request was made to authenticate to a wired network
5712
A Remote Procedure Call (RPC) was attempted
5888
An object in the COM+ Catalog was modified
5889
An object was deleted from the COM+ Catalog
5890
An object was added to the COM+ Catalog
6144
Security policy in the group policy objects has been applied successfully
6145
One or more errors occurred while processing security policy in the group policy objects
6272
Network Policy Server granted access to a user
6273
Network Policy Server denied access to a user
6274
Network Policy Server discarded the request for a user
6275
Network Policy Server discarded the accounting request for a user
6276
Network Policy Server quarantined a user
6277
Network Policy Server granted access to a user but put it on probation because the host did not meet the defined health policy
6278
Network Policy Server granted full access to a user because the host met the defined health policy
6279
Network Policy Server locked the user account due to repeated failed authentication attempts
6280
Network Policy Server unlocked the user account
6281
Code Integrity determined that the page hashes of an image file are not valid…
6400
BranchCache: Received an incorrectly formatted response while discovering availability of content.
6401
BranchCache: Received invalid data from a peer. Data discarded.
6402
BranchCache: The message to the hosted cache offering it data is incorrectly formatted.
6403
BranchCache: The hosted cache sent an incorrectly formatted response to the client’s message to offer it data.
6404
BranchCache: Hosted cache could not be authenticated using the provisioned SSL certificate.
6405
BranchCache: %2 instance(s) of event id %1 occurred.
6406
%1 registered to Windows Firewall to control filtering for the following:
6407
%1
6408
Registered product %1 failed and Windows Firewall is now controlling the filtering for %2.
6409
BranchCache: A service connection point object could not be parsed
6410
Code integrity determined that a file does not meet the security requirements to load into a process. This could be due to the use of shared sections or other issues
6416
A new external device was recognized by the system.
6417
The FIPS mode crypto selftests succeeded
6418
The FIPS mode crypto selftests failed
6419
A request was made to disable a device
6420
A device was disabled
6421
A request was made to enable a device
6422
A device was enabled
6423
The installation of this device is forbidden by system policy
6424
The installation of this device was allowed, after having previously been forbidden by policy
8191
Highest System-Defined Audit Message Value
Время на прочтение4 мин
Количество просмотров309K
Рэнди Франклин Смит (CISA, SSCP, Security MVP) имеет в своем арсенале очень полезный документ, рассказывающий о том, какие события (event IDs) обязательно должны отслеживаться в рамках обеспечения информационной безопасности Windows. В этом документе изложена крайне полезная информация, которая позволит Вам “выжать” максимум из штатной системы аудита. Мы подготовили перевод этого материала. Заинтересованных приглашаем под кат.
О том, как настроить аудит, мы уже обстоятельно писали в одном из наших постов. Но из всех event id, которые встречаются в журналах событий, необходимо остановить свое внимание на нескольких критических важных. На каких именно – решать каждому. Однако Рэнди Франклин Смит предлагает сосредоточить внимание на 10 важных событиях безопасности в Windows.
Контроллеры доменов
Event ID — (Категория) — Описание
1) 675 или 4771
(Аудит событий входа в систему)
Событие 675/4771 на контроллере домена указывает на неудачную попытку войти через Kerberos на рабочей станции с доменной учетной записью. Обычно причиной этого является несоответствующий пароль, но код ошибки указывает, почему именно аутентификация была неудачной. Таблица кодов ошибок Kerberos приведена ниже.
2) 676, или Failed 672 или 4768
(Аудит событий входа в систему)
Событие 676/4768 логгируется для других типов неудачной аутентификации. Таблица кодов Kerberos приведена ниже.
ВНИМАНИЕ: В Windows 2003 Server событие отказа записывается как 672 вместо 676.
3) 681 или Failed 680 или 4776
(Аудит событий входа в систему)
Событие 681/4776 на контроллере домена указывает на неудачную попытку входа в систему через
NTLM с доменной учетной записью. Код ошибки указывает, почему именно аутентификация была неудачной.
Коды ошибок NTLM приведены ниже.
ВНИМАНИЕ: В Windows 2003 Server событие отказа записывается как 680 вместо 681.
4) 642 или 4738
(Аудит управления учетными записями)
Событие 642/4738 указывает на изменения в указанной учетной записи, такие как сброс пароля или активация деактивированной до этого учетной записи. Описание события уточняется в соответствие с типом изменения.
5) 632 или 4728; 636 или 4732; 660 или 4756
(Аудит управления учетными записями)
Все три события указывают на то, что указанный пользователь был добавлен в определенную группу. Обозначены Глобальная (Global), Локальная (Local) и Общая (Universal) соответственно для каждого ID.
6) 624 или 4720
(Аудит управления учетными записями)
Была создана новая учетная запись пользователя
7) 644 или 4740
(Аудит управления учетными записями)
Учетная запись указанного пользователя была заблокирована после нескольких попыток входа
517 или 1102
(Аудит системных событий)
Указанный пользователь очистил журнал безопасности
Вход и выход из системы (Logon/Logoff)
Event Id — Описание
528 или 4624 — Успешный вход в систему
529 или 4625 — Отказ входа в систему – Неизвестное имя пользователя или неверный пароль
530 или 4625 Отказ входа в систему – Вход в систему не был осуществлен в течение обозначенного периода времени
531 или 4625 — Отказ входа в систему – Учетная запись временно деактивирована
532 или 4625 — Отказ входа в систему – Срок использования указанной учетной записи истек
533 или 4625 — Отказ входа в систему – Пользователю не разрешается осуществлять вход в систему на данном компьютере
534 или 4625 или 5461 — Отказ входа в систему – Пользователь не был разрешен запрашиваемый тип входа на данном компьютере
535 или 4625 — Отказ входа в систему – Срок действия пароля указанной учетной записи истек
539 или 4625 — Отказ входа в систему – Учетная запись заблокирована
540 или 4624 — Успешный сетевой вход в систему (Только Windows 2000, XP, 2003)
Типы входов в систему (Logon Types)
Тип входа в систему — Описание
2 — Интерактивный (вход с клавиатуры или экрана системы)
3 — Сетевой (например, подключение к общей папке на этом компьютере из любого места в сети или IIS вход — Никогда не заходил 528 на Windows Server 2000 и выше. См. событие 540)
4 — Пакет (batch) (например, запланированная задача)
5 — Служба (Запуск службы)
7 — Разблокировка (например, необслуживаемая рабочая станция с защищенным паролем скринсейвером)
8 — NetworkCleartext (Вход с полномочиями (credentials), отправленными в виде простого текст. Часто обозначает вход в IIS с “базовой аутентификацией”)
9 — NewCredentials
10 — RemoteInteractive (Терминальные службы, Удаленный рабочий стол или удаленный помощник)
11 — CachedInteractive (вход с кешированными доменными полномочиями, например, вход на рабочую станцию, которая находится не в сети)
Коды отказов Kerberos
Код ошибки — Причина
6 — Имя пользователя не существует
12 — Ограничение рабочей машины; ограничение времени входа в систему
18 — Учетная запись деактивирована, заблокирована или истек срок ее действия
23 — Истек срок действия пароля пользователя
24 — Предварительная аутентификация не удалась; обычно причиной является неверный пароль
32 — Истек срок действия заявки. Это нормальное событие, которое логгируется учетными записями компьютеров
37 — Время на рабочей машины давно не синхронизировалось со временем на контроллере домена
Коды ошибок NTLM
Код ошибки (десятичная система) — Код ошибки (16-ричная система) — Описание
3221225572 — C0000064 — Такого имени пользователя не существует
3221225578 — C000006A — Верное имя пользователя, но неверный пароль
3221226036 — C0000234 — Учетная запись пользователя заблокирована
3221225586 — C0000072 — Учетная запись деактивирована
3221225583 — C000006F — Пользователь пытается войти в систему вне обозначенного периода времени (рабочего времени)
3221225584 — C0000070 — Ограничение рабочей станции
3221225875 — C0000193 — Истек срок действия учетной записи
3221225585 — C0000071 — Истек срок действия пароля
3221226020 — C0000224 — Пользователь должен поменять пароль при следующем входе в систему
Еще раз продублируем ссылку на скачивание документа на сайте Рэнди Франклина Смита www.ultimatewindowssecurity.com/securitylog/quickref/Default.aspx. Нужно будет заполнить небольшую форму, чтобы получить к нему доступ.
P.S. Хотите полностью автоматизировать работу с журналами событий? Попробуйте новую версию NetWrix Event Log Manager 4.0, которая осуществляет сбор и архивирование журналов событий, строит отчеты и генерирует оповещения в режиме реального времени. Программа собирает данные с многочисленных компьютеров сети, предупреждает Вас о критических событиях и централизованно хранит данные обо всех событиях в сжатом формате для удобства анализа архивных данных журналов. Доступна бесплатная версия программы для 10 контроллеров доменов и 100 компьютеров.
Windows event ID 4608 — Windows is starting up
Windows event ID 4609 — Windows is shutting down
Windows event ID 4610 — An authentication package has been loaded by the Local Security Authority
Windows event ID 4611 — A trusted logon process has been registered with the Local Security Authority
Windows event ID 4612 — Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits
Windows event ID 4614 — A notification package has been loaded by the Security Account Manager
Windows event ID 4615 — Invalid use of LPC port
Windows event ID 4616 — The system time was changed
Windows event ID 4618 — A monitored security event pattern has occurred
Windows event ID 4621 — Administrator recovered system from CrashOnAuditFail. Users who are not administrators will now be allowed to log on. Some auditable activity might not have been recorded
Windows event ID 4622 — A security package has been loaded by the Local Security Authority
Windows event ID 4624 — An account was successfully logged on
Windows event ID 4625 — An account failed to log on
Windows event ID 4634 — An account was logged off
Windows event ID 4646 — IKE DoS-prevention mode started
Windows event ID 4647 — User initiated logoff
Windows event ID 4648 — A logon was attempted using explicit credentials
Windows event ID 4649 — A replay attack was detected
Windows event ID 4650 — An IPsec Main Mode security association was established
Windows event ID 4651 — An IPsec Main Mode security association was established
Windows event ID 4652 — An IPsec Main Mode negotiation failed
Windows event ID 4653 — An IPsec Main Mode negotiation failed
Windows event ID 4654 — An IPsec Quick Mode negotiation failed
Windows event ID 4655 — An IPsec Main Mode security association ended
Windows event ID 4656 — A handle to an object was requested
Windows event ID 4657 — A registry value was modified
Windows event ID 4658 — The handle to an object was closed
Windows event ID 4659 — A handle to an object was requested with intent to delete
Windows event ID 4660 — An object was deleted
Windows event ID 4661 — A handle to an object was requested
Windows event ID 4662 — An operation was performed on an object
Windows event ID 4663 — An attempt was made to access an object
Windows event ID 4664 — An attempt was made to create a hard link
Windows event ID 4665 — An attempt was made to create an application client context
Windows event ID 4666 — An application attempted an operation:
Windows event ID 4667 — An application client context was deleted
Windows event ID 4668 — An application was initialized
Windows event ID 4670 — Permissions on an object were changed
Windows event ID 4671 — An application attempted to access a blocked ordinal through the TBS
Windows event ID 4672 — Special privileges assigned to new logon
Windows event ID 4673 — A privileged service was called
Windows event ID 4674 — An operation was attempted on a privileged object
Windows event ID 4675 — SIDs were filtered
Windows event ID 4688 — A new process has been created
Windows event ID 4689 — A process has exited
Windows event ID 4690 — An attempt was made to duplicate a handle to an object
Windows event ID 4691 — Indirect access to an object was requested
Windows event ID 4692 — Backup of data protection master key was attempted
Windows event ID 4693 — Recovery of data protection master key was attempted
Windows event ID 4694 — Protection of auditable protected data was attempted
Windows event ID 4695 — Unprotection of auditable protected data was attempted
Windows event ID 4696 — A primary token was assigned to process
Windows event ID 4697 — A service was installed in the system
Windows event ID 4698 — A scheduled task was created
Windows event ID 4699 — A scheduled task was deleted
Windows event ID 4700 — A scheduled task was enabled
Windows event ID 4701 — A scheduled task was disabled
Windows event ID 4702 — A scheduled task was updated
Windows event ID 4704 — A user right was assigned
Windows event ID 4705 — A user right was removed
Windows event ID 4706 — A new trust was created to a domain
Windows event ID 4707 — A trust to a domain was removed
Windows event ID 4709 — IPsec Services was started
Windows event ID 4710 — IPsec Services was disabled
Windows event ID 4711 — PAStore Engine %1
Windows event ID 4712 — IPsec Services encountered a potentially serious failure
Windows event ID 4713 — Kerberos policy was changed
Windows event ID 4714 — Encrypted data recovery policy was changed
Windows event ID 4715 — The audit policy (SACL) on an object was changed
Windows event ID 4716 — Trusted domain information was modified
Windows event ID 4717 — System security access was granted to an account
Windows event ID 4718 — System security access was removed from an account
Windows event ID 4719 — System audit policy was changed
Windows event ID 4720 — A user account was created
Windows event ID 4722 — A user account was enabled
Windows event ID 4723 — An attempt was made to change an account’s password
Windows event ID 4724 — An attempt was made to reset an account’s password
Windows event ID 4725 — A user account was disabled
Windows event ID 4726 — A user account was deleted
Windows event ID 4727 — A security-enabled global group was created
Windows event ID 4728 — A member was added to a security-enabled global group
Windows event ID 4729 — A member was removed from a security-enabled global group
Windows event ID 4730 — A security-enabled global group was deleted
Windows event ID 4731 — A security-enabled local group was created
Windows event ID 4732 — A member was added to a security-enabled local group
Windows event ID 4733 — A member was removed from a security-enabled local group
Windows event ID 4734 — A security-enabled local group was deleted
Windows event ID 4735 — A security-enabled local group was changed
Windows event ID 4737 — A security-enabled global group was changed
Windows event ID 4738 — A user account was changed
Windows event ID 4739 — Domain Policy was changed
Windows event ID 4740 — A user account was locked out
Windows event ID 4741 — A computer account was created
Windows event ID 4742 — A computer account was changed
Windows event ID 4743 — A computer account was deleted
Windows event ID 4744 — A security-disabled local group was created
Windows event ID 4745 — A security-disabled local group was changed
Windows event ID 4746 — A member was added to a security-disabled local group
Windows event ID 4747 — A member was removed from a security-disabled local group
Windows event ID 4748 — A security-disabled local group was deleted
Windows event ID 4749 — A security-disabled global group was created
Windows event ID 4750 — A security-disabled global group was changed
Windows event ID 4751 — A member was added to a security-disabled global group
Windows event ID 4752 — A member was removed from a security-disabled global group
Windows event ID 4753 — A security-disabled global group was deleted
Windows event ID 4754 — A security-enabled universal group was created
Windows event ID 4755 — A security-enabled universal group was changed
Windows event ID 4756 — A member was added to a security-enabled universal group
Windows event ID 4757 — A member was removed from a security-enabled universal group
Windows event ID 4758 — A security-enabled universal group was deleted
Windows event ID 4759 — A security-disabled universal group was created
Windows event ID 4760 — A security-disabled universal group was changed
Windows event ID 4761 — A member was added to a security-disabled universal group
Windows event ID 4762 — A member was removed from a security-disabled universal group
Windows event ID 4763 — A security-disabled universal group was deleted
Windows event ID 4764 — A group’s type was changed
Windows event ID 4765 — SID History was added to an account
Windows event ID 4766 — An attempt to add SID History to an account failed
Windows event ID 4767 — A user account was unlocked
Windows event ID 4768 — A Kerberos authentication ticket (TGT) was requested
Windows event ID 4769 — A Kerberos service ticket was requested
Windows event ID 4770 — A Kerberos service ticket was renewed
Windows event ID 4771 — Kerberos pre-authentication failed
Windows event ID 4772 — A Kerberos authentication ticket request failed
Windows event ID 4773 — A Kerberos service ticket request failed
Windows event ID 4774 — An account was mapped for logon
Windows event ID 4775 — An account could not be mapped for logon
Windows event ID 4776 — The domain controller attempted to validate the credentials for an account
Windows event ID 4777 — The domain controller failed to validate the credentials for an account
Windows event ID 4778 — A session was reconnected to a Window Station
Windows event ID 4779 — A session was disconnected from a Window Station
Windows event ID 4780 — The ACL was set on accounts which are members of administrators groups
Windows event ID 4781 — The name of an account was changed:
Windows event ID 4782 — The password hash an account was accessed
Windows event ID 4783 — A basic application group was created
Windows event ID 4784 — A basic application group was changed
Windows event ID 4785 — A member was added to a basic application group
Windows event ID 4786 — A member was removed from a basic application group
Windows event ID 4787 — A non-member was added to a basic application group
Windows event ID 4788 — A non-member was removed from a basic application group
Windows event ID 4789 — A basic application group was deleted
Windows event ID 4790 — An LDAP query group was created
Windows event ID 4791 — A basic application group was changed
Windows event ID 4792 — An LDAP query group was deleted
Windows event ID 4793 — The Password Policy Checking API was called
Windows event ID 4794 — An attempt was made to set the Directory Services Restore Mode
Windows event ID 4800 — The workstation was locked
Windows event ID 4801 — The workstation was unlocked
Windows event ID 4802 — The screen saver was invoked
Windows event ID 4803 — The screen saver was dismissed
Windows event ID 4816 — RPC detected an integrity violation while decrypting an incoming message
Windows event ID 4817 — Auditing settings on an object were changed
Windows event ID 4864 — A namespace collision was detected
Windows event ID 4865 — A trusted forest information entry was added
Windows event ID 4866 — A trusted forest information entry was removed
Windows event ID 4867 — A trusted forest information entry was modified
Windows event ID 4868 — The certificate manager denied a pending certificate request
Windows event ID 4869 — Certificate Services received a resubmitted certificate request
Windows event ID 4870 — Certificate Services revoked a certificate
Windows event ID 4871 — Certificate Services received a request to publish the certificate revocation list (CRL)
Windows event ID 4872 — Certificate Services published the certificate revocation list (CRL)
Windows event ID 4873 — A certificate request extension changed
Windows event ID 4874 — One or more certificate request attributes changed
Windows event ID 4875 — Certificate Services received a request to shut down
Windows event ID 4876 — Certificate Services backup started
Windows event ID 4877 — Certificate Services backup completed
Windows event ID 4878 — Certificate Services restore started
Windows event ID 4879 — Certificate Services restore completed
Windows event ID 4880 — Certificate Services started
Windows event ID 4881 — Certificate Services stopped
Windows event ID 4882 — The security permissions for Certificate Services changed
Windows event ID 4883 — Certificate Services retrieved an archived key
Windows event ID 4884 — Certificate Services imported a certificate into its database
Windows event ID 4885 — The audit filter for Certificate Services changed
Windows event ID 4886 — Certificate Services received a certificate request
Windows event ID 4887 — Certificate Services approved a certificate request and issued a certificate
Windows event ID 4888 — Certificate Services denied a certificate request
Windows event ID 4889 — Certificate Services set the status of a certificate request to pending
Windows event ID 4890 — The certificate manager settings for Certificate Services changed
Windows event ID 4891 — A configuration entry changed in Certificate Services
Windows event ID 4892 — A property of Certificate Services changed
Windows event ID 4893 — Certificate Services archived a key
Windows event ID 4894 — Certificate Services imported and archived a key
Windows event ID 4895 — Certificate Services published the CA certificate to Active Directory Domain Services
Windows event ID 4896 — One or more rows have been deleted from the certificate database
Windows event ID 4897 — Role separation enabled:
Windows event ID 4898 — Certificate Services loaded a template
Windows event ID 4899 — A Certificate Services template was updated
Windows event ID 4900 — Certificate Services template security was updated
Windows event ID 4902 — The Per-user audit policy table was created
Windows event ID 4904 — An attempt was made to register a security event source
Windows event ID 4905 — An attempt was made to unregister a security event source
Windows event ID 4906 — The CrashOnAuditFail value has changed
Windows event ID 4907 — Auditing settings on object were changed
Windows event ID 4908 — Special Groups Logon table modified
Windows event ID 4909 — The local policy settings for the TBS were changed
Windows event ID 4910 — The group policy settings for the TBS were changed
Windows event ID 4912 — Per User Audit Policy was changed
Windows event ID 4928 — An Active Directory replica source naming context was established
Windows event ID 4929 — An Active Directory replica source naming context was removed
Windows event ID 4930 — An Active Directory replica source naming context was modified
Windows event ID 4931 — An Active Directory replica destination naming context was modified
Windows event ID 4932 — Synchronization of a replica of an Active Directory naming context has begun
Windows event ID 4933 — Synchronization of a replica of an Active Directory naming context has ended
Windows event ID 4934 — Attributes of an Active Directory object were replicated
Windows event ID 4935 — Replication failure begins
Windows event ID 4936 — Replication failure ends
Windows event ID 4937 — A lingering object was removed from a replica
Windows event ID 4944 — The following policy was active when the Windows Firewall started
Windows event ID 4945 — A rule was listed when the Windows Firewall started
Windows event ID 4946 — A change has been made to Windows Firewall exception list. A rule was added
Windows event ID 4947 — A change has been made to Windows Firewall exception list. A rule was modified
Windows event ID 4948 — A change has been made to Windows Firewall exception list. A rule was deleted
Windows event ID 4949 — Windows Firewall settings were restored to the default values
Windows event ID 4950 — A Windows Firewall setting has changed
Windows event ID 4951 — A rule has been ignored because its major version number was not recognized by Windows Firewall
Windows event ID 4952 — Parts of a rule have been ignored because its minor version number was not recognized by Windows Firewall. The other parts of the rule will be enforced
Windows event ID 4953 — A rule has been ignored by Windows Firewall because it could not parse the rule
Windows event ID 4954 — Windows Firewall Group Policy settings have changed. The new settings have been applied
Windows event ID 4956 — Windows Firewall has changed the active profile
Windows event ID 4957 — Windows Firewall did not apply the following rule:
Windows event ID 4958 — Windows Firewall did not apply the following rule because the rule referred to items not configured on this computer:
Windows event ID 4960 — IPsec dropped an inbound packet that failed an integrity check. If this problem persists, it could indicate a network issue or that packets are being modified in transit to this computer. Verify that the packets sent from the remot
Windows event ID 4961 — IPsec dropped an inbound packet that failed a replay check. If this problem persists, it could indicate a replay attack against this computer
Windows event ID 4962 — IPsec dropped an inbound packet that failed a replay check. The inbound packet had too low a sequence number to ensure it was not a replay
Windows event ID 4963 — IPsec dropped an inbound clear text packet that should have been secured. This is usually due to the remote computer changing its IPsec policy without informing this computer. This could also be a spoofing attack attempt
Windows event ID 4964 — Special groups have been assigned to a new logon
Windows event ID 4965 — IPsec received a packet from a remote computer with an incorrect Security Parameter Index (SPI). This is usually caused by malfunctioning hardware that is corrupting packets. If these errors persist, verify that the packets sent fr
Windows event ID 4976 — IPsec received an invalid negotiation packet
Windows event ID 4977 — IPsec received an invalid negotiation packet
Windows event ID 4978 — IPsec received an invalid negotiation packet
Windows event ID 4979 — IPsec Main Mode and Extended Mode security associations were established
Windows event ID 4980 — IPsec Main Mode and Extended Mode security associations were established
Windows event ID 4981 — IPsec Main Mode and Extended Mode security associations were established
Windows event ID 4982 — IPsec Main Mode and Extended Mode security associations were established
Windows event ID 4983 — An IPsec Extended Mode negotiation failed
Windows event ID 4984 — An IPsec Extended Mode negotiation failed
Windows event ID 4985 — The state of a transaction has changed
Windows event ID 5024 — The Windows Firewall Service has started successfully
Windows event ID 5025 — The Windows Firewall Service has been stopped
Windows event ID 5027 — The Windows Firewall Service was unable to retrieve the security policy from the local storage. The service will continue enforcing the current policy
Windows event ID 5028 — The Windows Firewall Service was unable to parse the new security policy. The service will continue with currently enforced policy
Windows event ID 5029 — The Windows Firewall Service failed to initialize the driver. The service will continue to enforce the current policy
Windows event ID 5030 — The Windows Firewall Service failed to start
Windows event ID 5031 — The Windows Firewall Service blocked an application from accepting incoming connections on the network
Windows event ID 5032 — Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network
Windows event ID 5033 — The Windows Firewall Driver has started successfully
Windows event ID 5034 — The Windows Firewall Driver has been stopped
Windows event ID 5035 — The Windows Firewall Driver failed to start
Windows event ID 5037 — The Windows Firewall Driver detected critical runtime error. Terminating
Windows event ID 5038 — Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error
Windows event ID 5039 — A registry key was virtualized
Windows event ID 5040 — IPsec: An Authentication Set was added
Windows event ID 5041 — IPsec: An Authentication Set was modified
Windows event ID 5042 — IPsec: An Authentication Set was deleted
Windows event ID 5043 — IPsec: A Connection Security Rule was added
Windows event ID 5044 — IPsec: A Connection Security Rule was modified
Windows event ID 5045 — IPsec: A Connection Security Rule was deleted
Windows event ID 5046 — IPsec: A Crypto Set was added
Windows event ID 5047 — IPsec: A Crypto Set was modified
Windows event ID 5048 — IPsec: A Crypto Set was deleted
Windows event ID 5049 — An IPsec Security Association was deleted
Windows event ID 5050 — An attempt to programmatically disable the Windows Firewall using a call to INetFwProfile.FirewallEnabled(FALSE) interface was rejected because this API is not supported on Windows Vista
Windows event ID 5051 — A file was virtualized
Windows event ID 5056 — A cryptographic self test was performed
Windows event ID 5057 — A cryptographic primitive operation failed
Windows event ID 5058 — Key file operation
Windows event ID 5059 — Key migration operation
Windows event ID 5060 — Verification operation failed
Windows event ID 5061 — Cryptographic operation
Windows event ID 5062 — A kernel-mode cryptographic self test was performed
Windows event ID 5063 — A cryptographic provider operation was attempted
Windows event ID 5064 — A cryptographic context operation was attempted
Windows event ID 5065 — A cryptographic context modification was attempted
Windows event ID 5066 — A cryptographic function operation was attempted
Windows event ID 5067 — A cryptographic function modification was attempted
Windows event ID 5068 — A cryptographic function provider operation was attempted
Windows event ID 5069 — A cryptographic function property operation was attempted
Windows event ID 5070 — A cryptographic function property modification was attempted
Windows event ID 5120 — OCSP Responder Service Started
Windows event ID 5121 — OCSP Responder Service Stopped
Windows event ID 5122 — A Configuration entry changed in the OCSP Responder Service
Windows event ID 5123 — A configuration entry changed in the OCSP Responder Service
Windows event ID 5124 — A security setting was updated on OCSP Responder Service
Windows event ID 5125 — A request was submitted to OCSP Responder Service
Windows event ID 5126 — Signing Certificate was automatically updated by the OCSP Responder Service
Windows event ID 5127 — The OCSP Revocation Provider successfully updated the revocation information
Windows event ID 5136 — A directory service object was modified
Windows event ID 5137 — A directory service object was created
Windows event ID 5138 — A directory service object was undeleted
Windows event ID 5139 — A directory service object was moved
Windows event ID 5140 — A network share object was accessed
Windows event ID 5141 — A directory service object was deleted
Windows event ID 5142 — A network share object was added
Windows event ID 5143 — A network share object was modified
Windows event ID 5144 — A network share object was deleted
Windows event ID 5145 — A network share object was checked to see whether the client can be granted desired access
Windows event ID 5148 — The Windows Filtering Platform has detected a DoS attack and entered a defensive mode; packets associated with this attack will be discarded
Windows event ID 5149 — The DoS attack has subsided and normal processing is being resumed
Windows event ID 5150 — The Windows Filtering Platform has blocked a packet
Windows event ID 5151 — A more restrictive Windows Filtering Platform filter has blocked a packet
Windows event ID 5152 — The Windows Filtering Platform blocked a packet
Windows event ID 5153 — A more restrictive Windows Filtering Platform filter has blocked a packet
Windows event ID 5154 — The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections
Windows event ID 5155 — The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections
Windows event ID 5156 — The Windows Filtering Platform has allowed a connection
Windows event ID 5157 — The Windows Filtering Platform has blocked a connection
Windows event ID 5158 — The Windows Filtering Platform has permitted a bind to a local port
Windows event ID 5159 — The Windows Filtering Platform has blocked a bind to a local port
Windows event ID 5168 — Spn check for SMB/SMB2 failed
Windows event ID 5376 — Credential Manager credentials were backed up
Windows event ID 5377 — Credential Manager credentials were restored from a backup
Windows event ID 5378 — The requested credentials delegation was disallowed by policy
Windows event ID 5440 — The following callout was present when the Windows Filtering Platform Base Filtering Engine started
Windows event ID 5441 — The following filter was present when the Windows Filtering Platform Base Filtering Engine started
Windows event ID 5442 — The following provider was present when the Windows Filtering Platform Base Filtering Engine started
Windows event ID 5443 — The following provider context was present when the Windows Filtering Platform Base Filtering Engine started
Windows event ID 5444 — The following sub-layer was present when the Windows Filtering Platform Base Filtering Engine started
Windows event ID 5446 — A Windows Filtering Platform callout has been changed
Windows event ID 5447 — A Windows Filtering Platform filter has been changed
Windows event ID 5448 — A Windows Filtering Platform provider has been changed
Windows event ID 5449 — A Windows Filtering Platform provider context has been changed
Windows event ID 5450 — A Windows Filtering Platform sub-layer has been changed
Windows event ID 5451 — An IPsec Quick Mode security association was established
Windows event ID 5452 — An IPsec Quick Mode security association ended
Windows event ID 5453 — An IPsec negotiation with a remote computer failed because the IKE and AuthIP IPsec Keying Modules (IKEEXT) service is not started
Windows event ID 5456 — PAStore Engine applied Active Directory storage IPsec policy on the computer
Windows event ID 5457 — PAStore Engine failed to apply Active Directory storage IPsec policy on the computer
Windows event ID 5458 — PAStore Engine applied locally cached copy of Active Directory storage IPsec policy on the computer
Windows event ID 5459 — PAStore Engine failed to apply locally cached copy of Active Directory storage IPsec policy on the computer
Windows event ID 5460 — PAStore Engine applied local registry storage IPsec policy on the computer
Windows event ID 5461 — PAStore Engine failed to apply local registry storage IPsec policy on the computer
Windows event ID 5462 — PAStore Engine failed to apply some rules of the active IPsec policy on the computer. Use the IP Security Monitor snap-in to diagnose the problem
Windows event ID 5463 — PAStore Engine polled for changes to the active IPsec policy and detected no changes
Windows event ID 5464 — PAStore Engine polled for changes to the active IPsec policy, detected changes, and applied them to IPsec Services
Windows event ID 5465 — PAStore Engine received a control for forced reloading of IPsec policy and processed the control successfully
Windows event ID 5466 — PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory cannot be reached, and will use the cached copy of the Active Directory IPsec policy instead. Any changes made to the Active D
Windows event ID 5467 — PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, and found no changes to the policy. The cached copy of the Active Directory IPsec policy is no longer being us
Windows event ID 5468 — PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, found changes to the policy, and applied those changes. The cached copy of the Active Directory IPsec policy i
Windows event ID 5471 — PAStore Engine loaded local storage IPsec policy on the computer
Windows event ID 5472 — PAStore Engine failed to load local storage IPsec policy on the computer
Windows event ID 5473 — PAStore Engine loaded directory storage IPsec policy on the computer
Windows event ID 5474 — PAStore Engine failed to load directory storage IPsec policy on the computer
Windows event ID 5477 — PAStore Engine failed to add quick mode filter
Windows event ID 5478 — IPsec Services has started successfully
Windows event ID 5479 — IPsec Services has been shut down successfully. The shutdown of IPsec Services can put the computer at greater risk of network attack or expose the computer to potential security risks
Windows event ID 5480 — IPsec Services failed to get the complete list of network interfaces on the computer. This poses a potential security risk because some of the network interfaces may not get the protection provided by the applied IPsec filters. Use
Windows event ID 5483 — IPsec Services failed to initialize RPC server. IPsec Services could not be started
Windows event ID 5484 — IPsec Services has experienced a critical failure and has been shut down. The shutdown of IPsec Services can put the computer at greater risk of network attack or expose the computer to potential security risks
Windows event ID 5485 — IPsec Services failed to process some IPsec filters on a plug-and-play event for network interfaces. This poses a potential security risk because some of the network interfaces may not get the protection provided by the applied IPs
Windows event ID 5632 — A request was made to authenticate to a wireless network
Windows event ID 5633 — A request was made to authenticate to a wired network
Windows event ID 5712 — A Remote Procedure Call (RPC) was attempted
Windows event ID 5888 — An object in the COM+ Catalog was modified
Windows event ID 5889 — An object was deleted from the COM+ Catalog
Windows event ID 5890 — An object was added to the COM+ Catalog
Windows event ID 6144 — Security policy in the group policy objects has been applied successfully
Windows event ID 6145 — One or more errors occurred while processing security policy in the group policy objects
Windows event ID 6272 — Network Policy Server granted access to a user
Windows event ID 6273 — Network Policy Server denied access to a user
Windows event ID 6274 — Network Policy Server discarded the request for a user
Windows event ID 6275 — Network Policy Server discarded the accounting request for a user
Windows event ID 6276 — Network Policy Server quarantined a user
Windows event ID 6277 — Network Policy Server granted access to a user but put it on probation because the host did not meet the defined health policy
Windows event ID 6278 — Network Policy Server granted full access to a user because the host met the defined health policy
Windows event ID 6279 — Network Policy Server locked the user account due to repeated failed authentication attempts
Windows event ID 6280 — Network Policy Server unlocked the user account
Windows event ID 6281 — Code Integrity determined that the page hashes of an image file are not valid. The file could be improperly signed without page hashes or corrupt due to unauthorized modification. The invalid hashes could indicate a potential disk
Windows event ID 6400 — BranchCache: Received an incorrectly formatted response while discovering availability of content.
Windows event ID 6401 — BranchCache: Received invalid data from a peer. Data discarded.
Windows event ID 6402 — BranchCache: The message to the hosted cache offering it data is incorrectly formatted.
Windows event ID 6403 — BranchCache: The hosted cache sent an incorrectly formatted response to the client
Windows event ID 6404 — BranchCache: Hosted cache could not be authenticated using the provisioned SSL certificate.
Windows event ID 6405 — BranchCache: %2 instance(s) of event id %1 occurred
Windows event ID 6406 — %1 registered to Windows Firewall to control filtering for the following: %2
Windows event ID 6407 — 1%
Windows event ID 6408 — Registered product %1 failed and Windows Firewall is now controlling the filtering for %2
Windows event ID 8191 — Highest System-Defined Audit Message Value
Views: 31
- Windows System Logs
- Event ID 1074
(System Shutdown/Restart): This event log indicates when and why the system was shut down or restarted. By monitoring these events, you can determine if there are unexpected shutdowns or restarts, potentially revealing malicious activity such as malware infection or unauthorized user access. - Event ID 6005
(The Event log service was started): This event log marks the time when the Event Log Service was started. This is an important record, as it can signify a system boot-up, providing a starting point for investigating system performance or potential security incidents around that period. It can also be used to detect unauthorized system reboots. - Event ID 6006
(The Event log service was stopped): This event log signifies the moment when the Event Log Service was stopped. It is typically seen when the system is shutting down. Abnormal or unexpected occurrences of this event could point to intentional service disruption for covering illicit activities. - Event ID 6013
(Windows uptime): This event occurs once a day and shows the uptime of the system in seconds. A shorter than expected uptime could mean the system has been rebooted, which could signify a potential intrusion or unauthorized activities on the system. - Event ID 7040
(Service status change): This event indicates a change in service startup type, which could be from manual to automatic or vice versa. If a crucial service’s startup type is changed, it could be a sign of system tampering.
- Event ID 1074
- Windows Security Logs
- Event ID 1102
(The audit log was cleared): Clearing the audit log is often a sign of an attempt to remove evidence of an intrusion or malicious activity. - Event ID 1116
(Antivirus malware detection): This event is particularly important because it logs when Defender detects a malware. A surge in these events could indicate a targeted attack or widespread malware infection. - Event ID 1118
(Antivirus remediation activity has started): This event signifies that Defender has begun the process of removing or quarantining detected malware. It’s important to monitor these events to ensure that remediation activities are successful. - Event ID 1119
(Antivirus remediation activity has succeeded): This event signifies that the remediation process for detected malware has been successful. Regular monitoring of these events will help ensure that identified threats are effectively neutralized. - Event ID 1120
(Antivirus remediation activity has failed): This event is the counterpart to 1119 and indicates that the remediation process has failed. These events should be closely monitored and addressed immediately to ensure threats are effectively neutralized. - Event ID 4624
(Successful Logon): This event records successful logon events. This information is vital for establishing normal user behavior. Abnormal behavior, such as logon attempts at odd hours or from different locations, could signify a potential security threat. - Event ID 4625
(Failed Logon): This event logs failed logon attempts. Multiple failed logon attempts could signify a brute-force attack in progress. - Event ID 4648
(A logon was attempted using explicit credentials): This event is triggered when a user logs on with explicit credentials to run a program. Anomalies in these logon events could indicate lateral movement within a network, which is a common technique used by attackers. - Event ID 4656
(A handle to an object was requested): This event is triggered when a handle to an object (like a file, registry key, or process) is requested. This can be a useful event for detecting attempts to access sensitive resources. - Event ID 4672
(Special Privileges Assigned to a New Logon): This event is logged whenever an account logs on with super user privileges. Tracking these events helps to ensure that super user privileges are not being abused or used maliciously. - Event ID 4698
(A scheduled task was created): This event is triggered when a scheduled task is created. Monitoring this event can help you detect persistence mechanisms, as attackers often use scheduled tasks to maintain access and run malicious code. - Event ID 4700 & Event ID 4701
(A scheduled task was enabled/disabled): This records the enabling or disabling of a scheduled task. Scheduled tasks are often manipulated by attackers for persistence or to run malicious code, thus these logs can provide valuable insight into suspicious activities. - Event ID 4702
(A scheduled task was updated): Similar to 4698, this event is triggered when a scheduled task is updated. Monitoring these updates can help detect changes that may signify malicious intent. - Event ID 4719
(System audit policy was changed): This event records changes to the audit policy on a computer. It could be a sign that someone is trying to cover their tracks by turning off auditing or changing what events get audited. - Event ID 4738
(A user account was changed): This event records any changes made to user accounts, including changes to privileges, group memberships, and account settings. Unexpected account changes can be a sign of account takeover or insider threats. - Event ID 4771
(Kerberos pre-authentication failed): This event is similar to 4625 (failed logon) but specifically for Kerberos authentication. An unusual amount of these logs could indicate an attacker attempting to brute force your Kerberos service. - Event ID 4776
(The domain controller attempted to validate the credentials for an account): This event helps track both successful and failed attempts at credential validation by the domain controller. Multiple failures could suggest a brute-force attack. - Event ID 5001
(Antivirus real-time protection configuration has changed): This event indicates that the real-time protection settings of Defender have been modified. Unauthorized changes could indicate an attempt to disable or undermine the functionality of Defender. - Event ID 5140
(A network share object was accessed): This event is logged whenever a network share is accessed. This can be critical in identifying unauthorized access to network shares. - Event ID 5142
(A network share object was added): This event signifies the creation of a new network share. Unauthorized network shares could be used to exfiltrate data or spread malware across a network. - Event ID 5145
(A network share object was checked to see whether client can be granted desired access): This event indicates that someone attempted to access a network share. Frequent checks of this sort might indicate a user or a malware trying to map out the network shares for future exploits. - Event ID 5157
(The Windows Filtering Platform has blocked a connection): This is logged when the Windows Filtering Platform blocks a connection attempt. This can be helpful for identifying malicious traffic on your network. - Event ID 7045
(A service was installed in the system): A sudden appearance of unknown services might suggest malware installation, as many types of malware install themselves as services.
- Event ID 1102