Security Audit EventsCategorySubcategoryEvent IDMessage
SummaryMinimum Operating System RequirementAccount LogonCredential
Validation4774An account was mapped for logon.Windows Vista,
Windows Server 2008Account LogonCredential Validation4775An account
could not be mapped for logon.Windows Vista, Windows Server
2008Account LogonCredential Validation4776The domain controller
attempted to validate the credentials for an account.Windows Vista,
Windows Server 2008Account LogonCredential Validation4777The domain
controller failed to validate the credentials for an
account.Windows Vista, Windows Server 2008Account LogonKerberos
Authentication Service4768A Kerberos authentication ticket (TGT)
was requested.Windows Vista, Windows Server 2008Account
LogonKerberos Authentication Service4771Kerberos pre-authentication
failed.Windows Vista, Windows Server 2008Account LogonKerberos
Authentication Service4772A Kerberos authentication ticket request
failed.Windows Vista, Windows Server 2008Account LogonKerberos
Service Ticket Operations4769A Kerberos service ticket was
requested.Windows Vista, Windows Server 2008Account LogonKerberos
Service Ticket Operations4770A Kerberos service ticket was
renewed.Windows Vista, Windows Server 2008Account
ManagementApplication Group Management4783A basic application group
was created.Windows Vista, Windows Server 2008Account
ManagementApplication Group Management4784A basic application group
was changed.Windows Vista, Windows Server 2008Account
ManagementApplication Group Management4785A member was added to a
basic application group.Windows Vista, Windows Server 2008Account
ManagementApplication Group Management4786A member was removed from
a basic application group.Windows Vista, Windows Server 2008Account
ManagementApplication Group Management4787A non-member was added to
a basic application group.Windows Vista, Windows Server 2008Account
ManagementApplication Group Management4788A non-member was removed
from a basic application group.Windows Vista, Windows Server
2008Account ManagementApplication Group Management4789A basic
application group was deleted.Windows Vista, Windows Server
2008Account ManagementApplication Group Management4790An LDAP query
group was created.Windows Vista, Windows Server 2008Account
ManagementComputer Account Management4742A computer account was
changed.Windows Vista, Windows Server 2008Account
ManagementComputer Account Management4743A computer account was
deleted.Windows Vista, Windows Server 2008Account
ManagementDistribution Group Management4744A security-disabled
local group was created.Windows Vista, Windows Server 2008Account
ManagementDistribution Group Management4745A security-disabled
local group was changed.Windows Vista, Windows Server 2008Account
ManagementDistribution Group Management4746A member was added to a
security-disabled local group.Windows Vista, Windows Server
2008Account ManagementDistribution Group Management4747A member was
removed from a security-disabled local group.Windows Vista, Windows
Server 2008Account ManagementDistribution Group Management4748A
security-disabled local group was deleted.Windows Vista, Windows
Server 2008Account ManagementDistribution Group Management4749A
security-disabled global group was created.Windows Vista, Windows
Server 2008Account ManagementDistribution Group Management4750A
security-disabled global group was changed.Windows Vista, Windows
Server 2008Account ManagementDistribution Group Management4751A
member was added to a security-disabled global group.Windows Vista,
Windows Server 2008Account ManagementDistribution Group
Management4752A member was removed from a security-disabled global
group.Windows Vista, Windows Server 2008Account
ManagementDistribution Group Management4753A security-disabled
global group was deleted.Windows Vista, Windows Server 2008Account
ManagementDistribution Group Management4759A security-disabled
universal group was created.Windows Vista, Windows Server
2008Account ManagementDistribution Group Management4760A
security-disabled universal group was changed.Windows Vista,
Windows Server 2008Account ManagementDistribution Group
Management4761A member was added to a security-disabled universal
group.Windows Vista, Windows Server 2008Account
ManagementDistribution Group Management4762A member was removed
from a security-disabled universal group.Windows Vista, Windows
Server 2008Account ManagementOther Account Management Events4782The
password hash an account was accessed.Windows Vista, Windows Server
2008Account ManagementOther Account Management Events4793The
Password Policy Checking API was called.Windows Vista, Windows
Server 2008Account ManagementSecurity Group Management4727A
security-enabled global group was created.Windows Vista, Windows
Server 2008Account ManagementSecurity Group Management4728A member
was added to a security-enabled global group.Windows Vista, Windows
Server 2008Account ManagementSecurity Group Management4729A member
was removed from a security-enabled global group.Windows Vista,
Windows Server 2008Account ManagementSecurity Group Management4730A
security-enabled global group was deleted.Windows Vista, Windows
Server 2008Account ManagementSecurity Group Management4731A
security-enabled local group was created.Windows Vista, Windows
Server 2008Account ManagementSecurity Group Management4732A member
was added to a security-enabled local group.Windows Vista, Windows
Server 2008Account ManagementSecurity Group Management4733A member
was removed from a security-enabled local group.Windows Vista,
Windows Server 2008Account ManagementSecurity Group Management4734A
security-enabled local group was deleted.Windows Vista, Windows
Server 2008Account ManagementSecurity Group Management4735A
security-enabled local group was changed.Windows Vista, Windows
Server 2008Account ManagementSecurity Group Management4737A
security-enabled global group was changed.Windows Vista, Windows
Server 2008Account ManagementSecurity Group Management4754A
security-enabled universal group was created.Windows Vista, Windows
Server 2008Account ManagementSecurity Group Management4755A
security-enabled universal group was changed.Windows Vista, Windows
Server 2008Account ManagementSecurity Group Management4756A member
was added to a security-enabled universal group.Windows Vista,
Windows Server 2008Account ManagementSecurity Group Management4757A
member was removed from a security-enabled universal group.Windows
Vista, Windows Server 2008Account ManagementSecurity Group
Management4758A security-enabled universal group was
deleted.Windows Vista, Windows Server 2008Account
ManagementSecurity Group Management4764A groups type was
changed.Windows Vista, Windows Server 2008Account ManagementUser
Account Management4720A user account was created.Windows Vista,
Windows Server 2008Account ManagementUser Account Management4722A
user account was enabled.Windows Vista, Windows Server 2008Account
ManagementUser Account Management4723An attempt was made to change
an account's password.Windows Vista, Windows Server 2008Account
ManagementUser Account Management4724An attempt was made to reset
an account's password.Windows Vista, Windows Server 2008Account
ManagementUser Account Management4725A user account was
disabled.Windows Vista, Windows Server 2008Account ManagementUser
Account Management4726A user account was deleted.Windows Vista,
Windows Server 2008Account ManagementUser Account Management4738A
user account was changed.Windows Vista, Windows Server 2008Account
ManagementUser Account Management4740A user account was locked
out.Windows Vista, Windows Server 2008Account ManagementUser
Account Management4765SID History was added to an account.Windows
Vista, Windows Server 2008Account ManagementUser Account
Management4766An attempt to add SID History to an account
failed.Windows Vista, Windows Server 2008Account ManagementUser
Account Management4767A user account was unlocked.Windows Vista,
Windows Server 2008Account ManagementUser Account Management4780The
ACL was set on accounts which are members of administrators
groups.Windows Vista, Windows Server 2008Account ManagementUser
Account Management4781The name of an account was changed:Windows
Vista, Windows Server 2008Account ManagementUser Account
Management4794An attempt was made to set the Directory Services
Restore Mode.Windows Vista, Windows Server 2008Account
ManagementUser Account Management5376Credential Manager credentials
were backed up.Windows Vista, Windows Server 2008Account
ManagementUser Account Management5377Credential Manager credentials
were restored from a backup.Windows Vista, Windows Server
2008Detailed TrackingDPAPI Activity4692Backup of data protection
master key was attempted.Windows Vista, Windows Server 2008Detailed
TrackingDPAPI Activity4693Recovery of data protection master key
was attempted.Windows Vista, Windows Server 2008Detailed
TrackingDPAPI Activity4694Protection of auditable protected data
was attempted.Windows Vista, Windows Server 2008Detailed
TrackingDPAPI Activity4695Unprotection of auditable protected data
was attempted.Windows Vista, Windows Server 2008Detailed
TrackingProcess Creation4688A new process has been created.Windows
Vista, Windows Server 2008Detailed TrackingProcess Creation4696A
primary token was assigned to process.Windows Vista, Windows Server
2008Detailed TrackingProcess Termination4689A process has
exited.Windows Vista, Windows Server 2008Detailed TrackingRPC
Events5712A Remote Procedure Call (RPC) was attempted.Windows
Vista, Windows Server 2008DS AccessDetailed Directory Service
Replication4928An Active Directory replica source naming context
was established.Windows Vista, Windows Server 2008DS AccessDetailed
Directory Service Replication4929An Active Directory replica source
naming context was removed.Windows Vista, Windows Server 2008DS
AccessDetailed Directory Service Replication4930An Active Directory
replica source naming context was modified.Windows Vista, Windows
Server 2008DS AccessDetailed Directory Service Replication4931An
Active Directory replica destination naming context was
modified.Windows Vista, Windows Server 2008DS AccessDetailed
Directory Service Replication4934Attributes of an Active Directory
object were replicated.Windows Vista, Windows Server 2008DS
AccessDetailed Directory Service Replication4935Replication failure
begins.Windows Vista, Windows Server 2008DS AccessDetailed
Directory Service Replication4936Replication failure ends.Windows
Vista, Windows Server 2008DS AccessDetailed Directory Service
Replication4937A lingering object was removed from a
replica.Windows Vista, Windows Server 2008DS AccessDirectory
Service Access4662An operation was performed on an object.Windows
Vista, Windows Server 2008DS AccessDirectory Service Changes5136A
directory service object was modified.Windows Vista, Windows Server
2008DS AccessDirectory Service Changes5137A directory service
object was created.Windows Vista, Windows Server 2008DS
AccessDirectory Service Changes5138A directory service object was
undeleted.Windows Vista, Windows Server 2008DS AccessDirectory
Service Changes5139A directory service object was moved.Windows
Vista, Windows Server 2008DS AccessDirectory Service Changes5141A
directory service object was deleted.Windows Vista SP1, Windows
Server 2008DS AccessDirectory Service
Replication4932Synchronization of a replica of an Active Directory
naming context has begun.Windows Vista, Windows Server 2008DS
AccessDirectory Service Replication4933Synchronization of a replica
of an Active Directory naming context has ended.Windows Vista,
Windows Server 2008Logon/LogoffAccount Lockout4625An account failed
to logonWindows Vista, Windows Server 2009Logon/LogoffIPsec
Extended Mode4978During Extended Mode negotiation, IPsec received
an invalid negotiation packet. If this problem persists, it could
indicate a network issue or an attempt to modify or replay this
negotiation.Windows Vista, Windows Server 2008Logon/LogoffIPsec
Extended Mode4979IPsec Main Mode and Extended Mode security
associations were established.Windows Vista, Windows Server
2008Logon/LogoffIPsec Extended Mode4980IPsec Main Mode and Extended
Mode security associations were established.Windows Vista, Windows
Server 2008Logon/LogoffIPsec Extended Mode4981IPsec Main Mode and
Extended Mode security associations were established.Windows Vista,
Windows Server 2008Logon/LogoffIPsec Extended Mode4982IPsec Main
Mode and Extended Mode security associations were
established.Windows Vista, Windows Server 2008Logon/LogoffIPsec
Extended Mode4983An IPsec Extended Mode negotiation failed. The
corresponding Main Mode security association has been
deleted.Windows Vista, Windows Server 2008Logon/LogoffIPsec
Extended Mode4984An IPsec Extended Mode negotiation failed. The
corresponding Main Mode security association has been
deleted.Windows Vista, Windows Server 2008Logon/LogoffIPsec Main
Mode4646IKE DoS-prevention mode started.Windows Vista, Windows
Server 2008Logon/LogoffIPsec Main Mode4650An IPsec Main Mode
security association was established. Extended Mode was not
enabled. Certificate authentication was not used.Windows Vista,
Windows Server 2008Logon/LogoffIPsec Main Mode4651An IPsec Main
Mode security association was established. Extended Mode was not
enabled. A certificate was used for authentication.Windows Vista,
Windows Server 2008Logon/LogoffIPsec Main Mode4652An IPsec Main
Mode negotiation failed.Windows Vista, Windows Server
2008Logon/LogoffIPsec Main Mode4653An IPsec Main Mode negotiation
failed.Windows Vista, Windows Server 2008Logon/LogoffIPsec Main
Mode4655An IPsec Main Mode security association ended.Windows
Vista, Windows Server 2008Logon/LogoffIPsec Main Mode4976During
Main Mode negotiation, IPsec received an invalid negotiation
packet. If this problem persists, it could indicate a network issue
or an attempt to modify or replay this negotiation.Windows Vista,
Windows Server 2008Logon/LogoffIPsec Main Mode5049An IPsec Security
Association was deleted.Windows Vista, Windows Server
2008Logon/LogoffIPsec Main Mode5453An IPsec negotiation with a
remote computer failed because the IKE and AuthIP IPsec Keying
Modules (IKEEXT) service is not started.Windows Vista, Windows
Server 2008Logon/LogoffIPsec Quick Mode4654An IPsec Quick Mode
negotiation failed.Windows Vista, Windows Server
2008Logon/LogoffIPsec Quick Mode4977During Quick Mode negotiation,
IPsec received an invalid negotiation packet. If this problem
persists, it could indicate a network issue or an attempt to modify
or replay this negotiation.Windows Vista, Windows Server
2008Logon/LogoffIPsec Quick Mode5451An IPsec Quick Mode security
association was established.Windows Vista, Windows Server
2008Logon/LogoffIPsec Quick Mode5452An IPsec Quick Mode security
association ended.Windows Vista, Windows Server
2008Logon/LogoffLogoff4634An account was logged off.Windows Vista,
Windows Server 2008Logon/LogoffLogoff4647User initiated
logoff.Windows Vista, Windows Server 2008Logon/LogoffLogon4624An
account was successfully logged on.Windows Vista, Windows Server
2008Logon/LogoffLogon4625An account failed to log on.Windows Vista,
Windows Server 2008Logon/LogoffLogon4648A logon was attempted using
explicit credentials.Windows Vista, Windows Server
2008Logon/LogoffLogon4675SIDs were filtered.Windows Vista, Windows
Server 2008Logon/LogoffNetwork Policy Server6272Network Policy
Server granted access to a user.Windows Vista SP1, Windows Server
2008Logon/LogoffNetwork Policy Server6273Network Policy Server
denied access to a user.Windows Vista SP1, Windows Server
2008Logon/LogoffNetwork Policy Server6274Network Policy Server
discarded the request for a user.Windows Vista SP1, Windows Server
2008Logon/LogoffNetwork Policy Server6275Network Policy Server
discarded the accounting request for a user.Windows Vista SP1,
Windows Server 2008Logon/LogoffNetwork Policy Server6276Network
Policy Server quarantined a user.Windows Vista SP1, Windows Server
2008Logon/LogoffNetwork Policy Server6277Network Policy Server
granted access to a user but put it on probation because the host
did not meet the defined health policy.Windows Vista SP1, Windows
Server 2008Logon/LogoffNetwork Policy Server6278Network Policy
Server granted full access to a user because the host met the
defined health policy.Windows Vista SP1, Windows Server
2008Logon/LogoffNetwork Policy Server6279Network Policy Server
locked the user account due to repeated failed authentication
attempts.Windows Vista SP1, Windows Server 2008Logon/LogoffNetwork
Policy Server6280Network Policy Server unlocked the user
account.Windows Vista SP1, Windows Server 2008Logon/LogoffOther
Logon/Logoff Events4649A replay attack was detected.Windows Vista,
Windows Server 2008Logon/LogoffOther Logon/Logoff Events4778A
session was reconnected to a Window Station.Windows Vista, Windows
Server 2008Logon/LogoffOther Logon/Logoff Events4779A session was
disconnected from a Window Station.Windows Vista, Windows Server
2008Logon/LogoffOther Logon/Logoff Events4800The workstation was
locked.Windows Vista, Windows Server 2008Logon/LogoffOther
Logon/Logoff Events4801The workstation was unlocked.Windows Vista,
Windows Server 2008Logon/LogoffOther Logon/Logoff Events4802The
screen saver was invoked.Windows Vista, Windows Server
2008Logon/LogoffOther Logon/Logoff Events4803The screen saver was
dismissed.Windows Vista, Windows Server 2008Logon/LogoffOther
Logon/Logoff Events5378The requested credentials delegation was
disallowed by policy.Windows Vista, Windows Server
2008Logon/LogoffOther Logon/Logoff Events5632A request was made to
authenticate to a wireless network.Windows Vista, Windows Server
2008Logon/LogoffOther Logon/Logoff Events5633A request was made to
authenticate to a wired network.Windows Vista, Windows Server
2008Logon/LogoffSpecial Logon4964Special groups have been assigned
to a new logon.Windows Vista, Windows Server 2008Object
AccessApplication Generated4665An attempt was made to create an
application client context.Windows Vista, Windows Server 2008Object
AccessApplication Generated4666An application attempted an
operation:Windows Vista, Windows Server 2008Object
AccessApplication Generated4667An application client context was
deleted.Windows Vista, Windows Server 2008Object AccessApplication
Generated4668An application was initialized.Windows Vista, Windows
Server 2008Object AccessCertification Services4868The certificate
manager denied a pending certificate request.Windows Vista, Windows
Server 2008Object AccessCertification Services4869Certificate
Services received a resubmitted certificate request.Windows Vista,
Windows Server 2008Object AccessCertification
Services4870Certificate Services revoked a certificate.Windows
Vista, Windows Server 2008Object AccessCertification
Services4871Certificate Services received a request to publish the
certificate revocation list (CRL).Windows Vista, Windows Server
2008Object AccessCertification Services4872Certificate Services
published the certificate revocation list (CRL).Windows Vista,
Windows Server 2008Object AccessCertification Services4873A
certificate request extension changed.Windows Vista, Windows Server
2008Object AccessCertification Services4874One or more certificate
request attributes changed.Windows Vista, Windows Server 2008Object
AccessCertification Services4875Certificate Services received a
request to shut down.Windows Vista, Windows Server 2008Object
AccessCertification Services4876Certificate Services backup
started.Windows Vista, Windows Server 2008Object
AccessCertification Services4877Certificate Services backup
completed.Windows Vista, Windows Server 2008Object
AccessCertification Services4878Certificate Services restore
started.Windows Vista, Windows Server 2008Object
AccessCertification Services4879Certificate Services restore
completed.Windows Vista, Windows Server 2008Object
AccessCertification Services4880Certificate Services
started.Windows Vista, Windows Server 2008Object
AccessCertification Services4881Certificate Services
stopped.Windows Vista, Windows Server 2008Object
AccessCertification Services4882The security permissions for
Certificate Services changed.Windows Vista, Windows Server
2008Object AccessCertification Services4883Certificate Services
retrieved an archived key.Windows Vista, Windows Server 2008Object
AccessCertification Services4884Certificate Services imported a
certificate into its database.Windows Vista, Windows Server
2008Object AccessCertification Services4885The audit filter for
Certificate Services changed.Windows Vista, Windows Server
2008Object AccessCertification Services4886Certificate Services
received a certificate request.Windows Vista, Windows Server
2008Object AccessCertification Services4887Certificate Services
approved a certificate request and issued a certificate.Windows
Vista, Windows Server 2008Object AccessCertification
Services4888Certificate Services denied a certificate
request.Windows Vista, Windows Server 2008Object
AccessCertification Services4889Certificate Services set the status
of a certificate request to pending.Windows Vista, Windows Server
2008Object AccessCertification Services4890The certificate manager
settings for Certificate Services changed.Windows Vista, Windows
Server 2008Object AccessCertification Services4891A configuration
entry changed in Certificate Services.Windows Vista, Windows Server
2008Object AccessCertification Services4892A property of
Certificate Services changed.Windows Vista, Windows Server
2008Object AccessCertification Services4893Certificate Services
archived a key.Windows Vista, Windows Server 2008Object
AccessCertification Services4894Certificate Services imported and
archived a key.Windows Vista, Windows Server 2008Object
AccessCertification Services4895Certificate Services published the
CA certificate to Active Directory Domain Services.Windows Vista,
Windows Server 2008Object AccessCertification Services4896One or
more rows have been deleted from the certificate database.Windows
Vista, Windows Server 2008Object AccessCertification
Services4897Role separation enabled:Windows Vista, Windows Server
2008Object AccessCertification Services4898Certificate Services
loaded a template.Windows Vista, Windows Server 2008Object
AccessDetailed File Share5145A network share object was checked to
see whether the client can be granted desired access.Windows 7,
Windows Server 2008 R2Object AccessFile Share5140A network share
object was accessed.Windows Vista, Windows Server 2008Object
AccessFile Share5142A network share object was added.Windows 7,
Windows Server 2008 R2Object AccessFile Share5143A network share
object was modified.Windows 7, Windows Server 2008 R2Object
AccessFile Share5144A network share object was deleted.Windows 7,
Windows Server 2008 R2Object AccessFile Share5168Spn check for
SMB/SMB2 failed.Windows 7, Windows Server 2008 R2Object AccessFile
System4664An attempt was made to create a hard link.Windows Vista,
Windows Server 2008Object AccessFile System4985The state of a
transaction has changed.Windows Vista, Windows Server 2008Object
AccessFile System5051A file was virtualized.Windows Vista, Windows
Server 2008Object AccessFiltering Platform Connection5031The
Windows Firewall Service blocked an application from accepting
incoming connections on the network.Windows Vista, Windows Server
2008Object AccessFiltering Platform Connection5154The Windows
Filtering Platform has permitted an application or service to
listen on a port for incoming connections.Windows Vista, Windows
Server 2008Object AccessFiltering Platform Connection5150The
Windows Filtering Platform has blocked a packet.Windows 7, Windows
Server 2008 R2Object AccessFiltering Platform Connection5151A more
restrictive Windows Filtering Platform filter has blocked a
packet.Windows 7, Windows Server 2008 R2Object AccessFiltering
Platform Connection5155The Windows Filtering Platform has blocked
an application or service from listening on a port for incoming
connections.Windows Vista, Windows Server 2008Object
AccessFiltering Platform Connection5156The Windows Filtering
Platform has allowed a connection.Windows Vista, Windows Server
2008Object AccessFiltering Platform Connection5157The Windows
Filtering Platform has blocked a connection.Windows Vista, Windows
Server 2008Object AccessFiltering Platform Connection5158The
Windows Filtering Platform has permitted a bind to a local
port.Windows Vista, Windows Server 2008Object AccessFiltering
Platform Connection5159The Windows Filtering Platform has blocked a
bind to a local port.Windows Vista, Windows Server 2008Object
AccessFiltering Platform Packet Drop5152The Windows Filtering
Platform blocked a packet.Windows Vista, Windows Server 2008Object
AccessFiltering Platform Packet Drop5153A more restrictive Windows
Filtering Platform filter has blocked a packet.Windows Vista,
Windows Server 2008Object AccessHandle Manipulation4656A handle to
an object was requested.Windows Vista, Windows Server 2008Object
AccessHandle Manipulation4658The handle to an object was
closed.Windows Vista, Windows Server 2008Object AccessHandle
Manipulation4690An attempt was made to duplicate a handle to an
object.Windows Vista, Windows Server 2008Object AccessOther Object
Access Events4671An application attempted to access a blocked
ordinal through the TBS.Windows Vista, Windows Server 2008Object
AccessOther Object Access Events4691Indirect access to an object
was requested.Windows Vista, Windows Server 2008Object AccessOther
Object Access Events4698A scheduled task was created.Windows Vista,
Windows Server 2008Object AccessOther Object Access Events4699A
scheduled task was deleted.Windows Vista, Windows Server 2008Object
AccessOther Object Access Events4700A scheduled task was
enabled.Windows Vista, Windows Server 2008Object AccessOther Object
Access Events4701A scheduled task was disabled.Windows Vista,
Windows Server 2008Object AccessOther Object Access Events4702A
scheduled task was updated.Windows Vista, Windows Server 2008Object
AccessOther Object Access Events5148The Windows Filtering Platform
has detected a DoS attack and entered a defensive mode; packets
associated with this attack will be discarded.Windows 7, Windows
Server 2008 R2Object AccessOther Object Access Events5149The DoS
attack has subsided and normal processing is being resumed.Windows
7, Windows Server 2008 R2Object AccessOther Object Access
Events5888An object in the COM+ Catalog was modified.Windows Vista,
Windows Server 2008Object AccessOther Object Access Events5889An
object was deleted from the COM+ Catalog.Windows Vista, Windows
Server 2008Object AccessOther Object Access Events5890An object was
added to the COM+ Catalog.Windows Vista, Windows Server 2008Object
AccessRegistry4657A registry value was modified.Windows Vista,
Windows Server 2008Object AccessRegistry5039A registry key was
virtualized.Windows Vista, Windows Server 2008Object
AccessSpecial4659A handle to an object was requested with intent to
delete.Windows Vista, Windows Server 2008Object AccessSpecial4660An
object was deleted.Windows Vista, Windows Server 2008Object
AccessSpecial4661A handle to an object was requested.Windows Vista,
Windows Server 2008Object AccessSpecial4663An attempt was made to
access an object.Windows Vista, Windows Server 2008Policy
ChangeAudit Policy Change4715The audit policy (SACL) on an object
was changed.Windows Vista, Windows Server 2008Policy ChangeAudit
Policy Change4719System audit policy was changed.Windows Vista,
Windows Server 2008Policy ChangeAudit Policy Change4817Auditing
settings on an object were changed.Windows 7, Windows Server 2008
R2Policy ChangeAudit Policy Change4902The Per-user audit policy
table was created.Windows Vista, Windows Server 2008Policy
ChangeAudit Policy Change4904An attempt was made to register a
security event source.Windows Vista, Windows Server 2008Policy
ChangeAudit Policy Change4905An attempt was made to unregister a
security event source.Windows Vista, Windows Server 2008Policy
ChangeAudit Policy Change4906The CrashOnAuditFail value has
changed.Windows Vista, Windows Server 2008Policy ChangeAudit Policy
Change4907Auditing settings on object were changed.Windows Vista,
Windows Server 2008Policy ChangeAudit Policy Change4908Special
Groups Logon table modified.Windows Vista, Windows Server
2008Policy ChangeAudit Policy Change4912Per User Audit Policy was
changed.Windows Vista, Windows Server 2008Policy
ChangeAuthentication Policy Change4713Kerberos policy was
changed.Windows Vista, Windows Server 2008Policy
ChangeAuthentication Policy Change4716Trusted domain information
was modified.Windows Vista, Windows Server 2008Policy
ChangeAuthentication Policy Change4717System security access was
granted to an account.Windows Vista, Windows Server 2008Policy
ChangeAuthentication Policy Change4718System security access was
removed from an account.Windows Vista, Windows Server 2008Policy
ChangeAuthentication Policy Change4739Domain Policy was
changed.Windows Vista, Windows Server 2008Policy
ChangeAuthentication Policy Change4864A namespace collision was
detected.Windows Vista, Windows Server 2008Policy
ChangeAuthentication Policy Change4865A trusted forest information
entry was added.Windows Vista, Windows Server 2008Policy
ChangeAuthentication Policy Change4866A trusted forest information
entry was removed.Windows Vista, Windows Server 2008Policy
ChangeAuthentication Policy Change4867A trusted forest information
entry was modified.Windows Vista, Windows Server 2008Policy
ChangeAuthorization Policy Change4704A user right was
assigned.Windows Vista, Windows Server 2008Policy
ChangeAuthorization Policy Change4705A user right was
removed.Windows Vista, Windows Server 2008Policy
ChangeAuthorization Policy Change4706A new trust was created to a
domain.Windows Vista, Windows Server 2008Policy ChangeAuthorization
Policy Change4707A trust to a domain was removed.Windows Vista,
Windows Server 2008Policy ChangeAuthorization Policy
Change4714Encrypted data recovery policy was changed.Windows Vista,
Windows Server 2008Policy ChangeFiltering Platform Policy
Change4709IPsec Services was started.Windows Vista, Windows Server
2008Policy ChangeFiltering Platform Policy Change4710IPsec Services
was disabled.Windows Vista, Windows Server 2008Policy
ChangeFiltering Platform Policy Change4711May contain any one of
the following: PAStore Engine applied locally cached copy of Active
Directory storage IPsec policy on the computer.PAStore Engine
applied Active Directory storage IPsec policy on the
computer.PAStore Engine applied local registry storage IPsec policy
on the computer.PAStore Engine failed to apply locally cached copy
of Active Directory storage IPsec policy on the computer.PAStore
Engine failed to apply Active Directory storage IPsec policy on the
computer.PAStore Engine failed to apply local registry storage
IPsec policy on the computer.PAStore Engine failed to apply some
rules of the active IPsec policy on the computer.PAStore Engine
failed to load directory storage IPsec policy on the
computer.PAStore Engine loaded directory storage IPsec policy on
the computer.PAStore Engine failed to load local storage IPsec
policy on the computer.PAStore Engine loaded local storage IPsec
policy on the computer.PAStore Engine polled for changes to the
active IPsec policy and detected no changes.Windows Vista, Windows
Server 2008Policy ChangeFiltering Platform Policy Change4712IPsec
Services encountered a potentially serious failure.Windows Vista,
Windows Server 2008Policy ChangeFiltering Platform Policy
Change5040A change has been made to IPsec settings. An
Authentication Set was added.Windows Vista, Windows Server
2008Policy ChangeFiltering Platform Policy Change5041A change has
been made to IPsec settings. An Authentication Set was
modified.Windows Vista, Windows Server 2008Policy ChangeFiltering
Platform Policy Change5042A change has been made to IPsec settings.
An Authentication Set was deleted.Windows Vista, Windows Server
2008Policy ChangeFiltering Platform Policy Change5043A change has
been made to IPsec settings. A Connection Security Rule was
added.Windows Vista, Windows Server 2008Policy ChangeFiltering
Platform Policy Change5044A change has been made to IPsec settings.
A Connection Security Rule was modified.Windows Vista, Windows
Server 2008Policy ChangeFiltering Platform Policy Change5045A
change has been made to IPsec settings. A Connection Security Rule
was deleted.Windows Vista, Windows Server 2008Policy
ChangeFiltering Platform Policy Change5046A change has been made to
IPsec settings. A Crypto Set was added.Windows Vista, Windows
Server 2008Policy ChangeFiltering Platform Policy Change5047A
change has been made to IPsec settings. A Crypto Set was
modified.Windows Vista, Windows Server 2008Policy ChangeFiltering
Platform Policy Change5048A change has been made to IPsec settings.
A Crypto Set was deleted.Windows Vista, Windows Server 2008Policy
ChangeFiltering Platform Policy Change5440The following callout was
present when the Windows Filtering Platform Base Filtering Engine
started.Windows Vista, Windows Server 2008Policy ChangeFiltering
Platform Policy Change5441The following filter was present when the
Windows Filtering Platform Base Filtering Engine started.Windows
Vista, Windows Server 2008Policy ChangeFiltering Platform Policy
Change5442The following provider was present when the Windows
Filtering Platform Base Filtering Engine started.Windows Vista,
Windows Server 2008Policy ChangeFiltering Platform Policy
Change5443The following provider context was present when the
Windows Filtering Platform Base Filtering Engine started.Windows
Vista, Windows Server 2008Policy ChangeFiltering Platform Policy
Change5444The following sub-layer was present when the Windows
Filtering Platform Base Filtering Engine started.Windows Vista,
Windows Server 2008Policy ChangeFiltering Platform Policy
Change5446A Windows Filtering Platform callout has been
changed.Windows Vista, Windows Server 2008Policy ChangeFiltering
Platform Policy Change5448A Windows Filtering Platform provider has
been changed.Windows Vista, Windows Server 2008Policy
ChangeFiltering Platform Policy Change5449A Windows Filtering
Platform provider context has been changed.Windows Vista, Windows
Server 2008Policy ChangeFiltering Platform Policy Change5450A
Windows Filtering Platform sub-layer has been changed.Windows
Vista, Windows Server 2008Policy ChangeFiltering Platform Policy
Change5456PAStore Engine applied Active Directory storage IPsec
policy on the computer.Windows Vista, Windows Server 2008Policy
ChangeFiltering Platform Policy Change5457PAStore Engine failed to
apply Active Directory storage IPsec policy on the computer.Windows
Vista, Windows Server 2008Policy ChangeFiltering Platform Policy
Change5458PAStore Engine applied locally cached copy of Active
Directory storage IPsec policy on the computer.Windows Vista,
Windows Server 2008Policy ChangeFiltering Platform Policy
Change5459PAStore Engine failed to apply locally cached copy of
Active Directory storage IPsec policy on the computer.Windows
Vista, Windows Server 2008Policy ChangeFiltering Platform Policy
Change5460PAStore Engine applied local registry storage IPsec
policy on the computer.Windows Vista, Windows Server 2008Policy
ChangeFiltering Platform Policy Change5461PAStore Engine failed to
apply local registry storage IPsec policy on the computer.Windows
Vista, Windows Server 2008Policy ChangeFiltering Platform Policy
Change5462PAStore Engine failed to apply some rules of the active
IPsec policy on the computer. Use the IP Security Monitor snap-in
to diagnose the problem.Windows Vista, Windows Server 2008Policy
ChangeFiltering Platform Policy Change5463PAStore Engine polled for
changes to the active IPsec policy and detected no changes.Windows
Vista, Windows Server 2008Policy ChangeFiltering Platform Policy
Change5464PAStore Engine polled for changes to the active IPsec
policy, detected changes, and applied them to IPsec
Services.Windows Vista, Windows Server 2008Policy ChangeFiltering
Platform Policy Change5465PAStore Engine received a control for
forced reloading of IPsec policy and processed the control
successfully.Windows Vista, Windows Server 2008Policy
ChangeFiltering Platform Policy Change5466PAStore Engine polled for
changes to the Active Directory IPsec policy, determined that
Active Directory cannot be reached, and will use the cached copy of
the Active Directory IPsec policy instead. Any changes made to the
Active Directory IPsec policy since the last poll could not be
applied.Windows Vista, Windows Server 2008Policy ChangeFiltering
Platform Policy Change5467PAStore Engine polled for changes to the
Active Directory IPsec policy, determined that Active Directory can
be reached, and found no changes to the policy. The cached copy of
the Active Directory IPsec policy is no longer being used.Windows
Vista, Windows Server 2008Policy ChangeFiltering Platform Policy
Change5468PAStore Engine polled for changes to the Active Directory
IPsec policy, determined that Active Directory can be reached,
found changes to the policy, and applied those changes. The cached
copy of the Active Directory IPsec policy is no longer being
used.Windows Vista, Windows Server 2008Policy ChangeFiltering
Platform Policy Change5471PAStore Engine loaded local storage IPsec
policy on the computer.Windows Vista, Windows Server 2008Policy
ChangeFiltering Platform Policy Change5472PAStore Engine failed to
load local storage IPsec policy on the computer.Windows Vista,
Windows Server 2008Policy ChangeFiltering Platform Policy
Change5473PAStore Engine loaded directory storage IPsec policy on
the computer.Windows Vista, Windows Server 2008Policy
ChangeFiltering Platform Policy Change5474PAStore Engine failed to
load directory storage IPsec policy on the computer.Windows Vista,
Windows Server 2008Policy ChangeFiltering Platform Policy
Change5477PAStore Engine failed to add quick mode filter.Windows
Vista, Windows Server 2008Policy ChangeMPSSVC Rule-Level Policy
Change4944The following policy was active when the Windows Firewall
started.Windows Vista, Windows Server 2008Policy ChangeMPSSVC
Rule-Level Policy Change4945A rule was listed when the Windows
Firewall started.Windows Vista, Windows Server 2008Policy
ChangeMPSSVC Rule-Level Policy Change4946A change has been made to
Windows Firewall exception list. A rule was added.Windows Vista,
Windows Server 2008Policy ChangeMPSSVC Rule-Level Policy
Change4947A change has been made to Windows Firewall exception
list. A rule was modified.Windows Vista, Windows Server 2008Policy
ChangeMPSSVC Rule-Level Policy Change4948A change has been made to
Windows Firewall exception list. A rule was deleted.Windows Vista,
Windows Server 2008Policy ChangeMPSSVC Rule-Level Policy
Change4949Windows Firewall settings were restored to the default
values.Windows Vista, Windows Server 2008Policy ChangeMPSSVC
Rule-Level Policy Change4950A Windows Firewall setting has
changed.Windows Vista, Windows Server 2008Policy ChangeMPSSVC
Rule-Level Policy Change4951A rule has been ignored because its
major version number was not recognized by Windows Firewall.Windows
Vista, Windows Server 2008Policy ChangeMPSSVC Rule-Level Policy
Change4952Parts of a rule have been ignored because its minor
version number was not recognized by Windows Firewall. The other
parts of the rule will be enforced.Windows Vista, Windows Server
2008Policy ChangeMPSSVC Rule-Level Policy Change4953A rule has been
ignored by Windows Firewall because it could not parse the
rule.Windows Vista, Windows Server 2008Policy ChangeMPSSVC
Rule-Level Policy Change4954Windows Firewall Group Policy settings
have changed. The new settings have been applied.Windows Vista,
Windows Server 2008Policy ChangeMPSSVC Rule-Level Policy
Change4956Windows Firewall has changed the active profile.Windows
Vista, Windows Server 2008Policy ChangeMPSSVC Rule-Level Policy
Change4957Windows Firewall did not apply the following rule:Windows
Vista, Windows Server 2008Policy ChangeMPSSVC Rule-Level Policy
Change4958Windows Firewall did not apply the following rule because
the rule referred to items not configured on this computer:Windows
Vista, Windows Server 2008Policy ChangeOther Policy Change
Events4909The local policy settings for the TBS were
changed.Windows Vista, Windows Server 2008Policy ChangeOther Policy
Change Events4910The group policy settings for the TBS were
changed.Windows Vista, Windows Server 2008Policy ChangeOther Policy
Change Events5063A cryptographic provider operation was
attempted.Windows Vista, Windows Server 2008Policy ChangeOther
Policy Change Events5064A cryptographic context operation was
attempted.Windows Vista, Windows Server 2008Policy ChangeOther
Policy Change Events5065A cryptographic context modification was
attempted.Windows Vista, Windows Server 2008Policy ChangeOther
Policy Change Events5066A cryptographic function operation was
attempted.Windows Vista, Windows Server 2008Policy ChangeOther
Policy Change Events5067A cryptographic function modification was
attempted.Windows Vista, Windows Server 2008Policy ChangeOther
Policy Change Events5068A cryptographic function provider operation
was attempted.Windows Vista, Windows Server 2008Policy ChangeOther
Policy Change Events5069A cryptographic function property operation
was attempted.Windows Vista, Windows Server 2008Policy ChangeOther
Policy Change Events5070A cryptographic function property
modification was attempted.Windows Vista, Windows Server 2008Policy
ChangeOther Policy Change Events5447A Windows Filtering Platform
filter has been changed.Windows Vista, Windows Server 2008Policy
ChangeOther Policy Change Events6144Security policy in the group
policy objects has been applied successfully.Windows Vista, Windows
Server 2008Policy ChangeOther Policy Change Events6145One or more
errors occurred while processing security policy in the group
policy objects.Windows Vista, Windows Server 2008Policy
ChangeSubcategory (special)4670Permissions on an object were
changed.Windows Vista, Windows Server 2008Privilege UseSensitive
Privilege Use / Non Sensitive Privilege Use4672Special privileges
assigned to new logon.Windows Vista, Windows Server 2008Privilege
UseSensitive Privilege Use / Non Sensitive Privilege Use4673A
privileged service was called.Windows Vista, Windows Server
2008Privilege UseSensitive Privilege Use / Non Sensitive Privilege
Use4674An operation was attempted on a privileged object.Windows
Vista, Windows Server 2008SystemIPsec Driver4960IPsec dropped an
inbound packet that failed an integrity check. If this problem
persists, it could indicate a network issue or that packets are
being modified in transit to this computer. Verify that the packets
sent from the remote computer are the same as those received by
this computer. This error might also indicate interoperability
problems with other IPsec implementations.Windows Vista, Windows
Server 2008SystemIPsec Driver4961IPsec dropped an inbound packet
that failed a replay check. If this problem persists, it could
indicate a replay attack against this computer.Windows Vista,
Windows Server 2008SystemIPsec Driver4962IPsec dropped an inbound
packet that failed a replay check. The inbound packet had too low a
sequence number to ensure it was not a replay.Windows Vista,
Windows Server 2008SystemIPsec Driver4963IPsec dropped an inbound
clear text packet that should have been secured. This is usually
due to the remote computer changing its IPsec policy without
informing this computer. This could also be a spoofing attack
attempt.Windows Vista, Windows Server 2008SystemIPsec
Driver4965IPsec received a packet from a remote computer with an
incorrect Security Parameter Index (SPI). This is usually caused by
malfunctioning hardware that is corrupting packets. If these errors
persist, verify that the packets sent from the remote computer are
the same as those received by this computer. This error may also
indicate interoperability problems with other IPsec
implementations. In that case, if connectivity is not impeded, then
these events can be ignored.Windows Vista, Windows Server
2008SystemIPsec Driver5478IPsec Services has started
successfully.Windows Vista, Windows Server 2008SystemIPsec
Driver5479IPsec Services has been shut down successfully. The
shutdown of IPsec Services can put the computer at greater risk of
network attack or expose the computer to potential security
risks.Windows Vista, Windows Server 2008SystemIPsec Driver5480IPsec
Services failed to get the complete list of network interfaces on
the computer. This poses a potential security risk because some of
the network interfaces may not get the protection provided by the
applied IPsec filters. Use the IP Security Monitor snap-in to
diagnose the problem.Windows Vista, Windows Server 2008SystemIPsec
Driver5483IPsec Services failed to initialize RPC server. IPsec
Services could not be started.Windows Vista, Windows Server
2008SystemIPsec Driver5484IPsec Services has experienced a critical
failure and has been shut down. The shutdown of IPsec Services can
put the computer at greater risk of network attack or expose the
computer to potential security risks.Windows Vista, Windows Server
2008SystemIPsec Driver5485IPsec Services failed to process some
IPsec filters on a plug-and-play event for network interfaces. This
poses a potential security risk because some of the network
interfaces may not get the protection provided by the applied IPsec
filters. Use the IP Security Monitor snap-in to diagnose the
problem.Windows Vista, Windows Server 2008SystemOther System
Events5024The Windows Firewall Service has started
successfully.Windows Vista, Windows Server 2008SystemOther System
Events5025The Windows Firewall Service has been stopped.Windows
Vista, Windows Server 2008SystemOther System Events5027The Windows
Firewall Service was unable to retrieve the security policy from
the local storage. The service will continue enforcing the current
policy.Windows Vista, Windows Server 2008SystemOther System
Events5028The Windows Firewall Service was unable to parse the new
security policy. The service will continue with currently enforced
policy.Windows Vista, Windows Server 2008SystemOther System
Events5029The Windows Firewall Service failed to initialize the
driver. The service will continue to enforce the current
policy.Windows Vista, Windows Server 2008SystemOther System
Events5030The Windows Firewall Service failed to start.Windows
Vista, Windows Server 2008SystemOther System Events5032Windows
Firewall was unable to notify the user that it blocked an
application from accepting incoming connections on the
network.Windows Vista, Windows Server 2008SystemOther System
Events5033The Windows Firewall Driver has started
successfully.Windows Vista, Windows Server 2008SystemOther System
Events5034The Windows Firewall Driver has been stopped.Windows
Vista, Windows Server 2008SystemOther System Events5035The Windows
Firewall Driver failed to start.Windows Vista, Windows Server
2008SystemOther System Events5037The Windows Firewall Driver
detected critical runtime error. Terminating.Windows Vista, Windows
Server 2008SystemOther System Events5058Key file operation.Windows
Vista, Windows Server 2008SystemOther System Events5059Key
migration operation.Windows Vista, Windows Server
2008SystemSecurity State Change4608Windows is starting up.Windows
Vista, Windows Server 2008SystemSecurity State Change4609Windows is
shutting down.Windows Vista, Windows Server 2008SystemSecurity
State Change4616The system time was changed.Windows Vista, Windows
Server 2008SystemSecurity State Change4621Administrator recovered
system from CrashOnAuditFail. Users who are not administrators will
now be allowed to log on. Some auditable activity might not have
been recorded.Windows Vista, Windows Server 2008SystemSecurity
System Extension4610An authentication package has been loaded by
the Local Security Authority.Windows Vista, Windows Server
2008SystemSecurity System Extension4611A trusted logon process has
been registered with the Local Security Authority.Windows Vista,
Windows Server 2008SystemSecurity System Extension4614A
notification package has been loaded by the Security Account
Manager.Windows Vista, Windows Server 2008SystemSecurity System
Extension4622A security package has been loaded by the Local
Security Authority.Windows Vista, Windows Server 2008SystemSecurity
System Extension4697A service was installed in the system.Windows
Vista, Windows Server 2008SystemSystem Integrity4612Internal
resources allocated for the queuing of audit messages have been
exhausted, leading to the loss of some audits.Windows Vista,
Windows Server 2008SystemSystem Integrity4615Invalid use of LPC
port.Windows Vista, Windows Server 2008SystemSystem Integrity4618A
monitored security event pattern has occurred.Windows Vista,
Windows Server 2008SystemSystem Integrity4816RPC detected an
integrity violation while decrypting an incoming message.Windows
Vista, Windows Server 2008SystemSystem Integrity5038Code integrity
determined that the image hash of a file is not valid. The file
could be corrupt due to unauthorized modification or the invalid
hash could indicate a potential disk device error.Windows Vista,
Windows Server 2008SystemSystem Integrity5056A cryptographic self
test was performed.Windows Vista, Windows Server 2008SystemSystem
Integrity5057A cryptographic primitive operation failed.Windows
Vista, Windows Server 2008SystemSystem Integrity5060Verification
operation failed.Windows Vista, Windows Server 2008SystemSystem
Integrity5061Cryptographic operation.Windows Vista, Windows Server
2008SystemSystem Integrity5062A kernel-mode cryptographic self test
was performed.Windows Vista, Windows Server 2008SystemSystem
Integrity6281Code Integrity determined that the page hashes of an
image file are not valid. The file could be improperly signed
without page hashes or corrupt due to unauthorized modification.
The invalid hashes could indicate a potential disk device
errorWindows 7, Windows Server 2008 R2SystemOther System
Events6400BranchCache: Received an incorrectly formatted response
while discovering availability of content.Windows 7, Windows Server
2008 R2SystemOther System Events6401BranchCache: Received invalid
data from a peer. Data discarded.Windows 7, Windows Server 2008
R2SystemOther System Events6402BranchCache: The message to the
hosted cache offering it data is incorrectly formatted.Windows 7,
Windows Server 2008 R2SystemOther System Events6403BranchCache: The
hosted cache sent an incorrectly formatted response to the
client.Windows 7, Windows Server 2008 R2SystemOther System
Events6404BranchCache: Hosted cache could not be authenticated
using the provisioned SSL certificate.Windows 7, Windows Server
2008 R2SystemOther System Events6405BranchCache: %2 instance(s) of
event id %1 occurred.Windows 7, Windows Server 2008 R2SystemOther
System Events6406%1 registered to Windows Firewall to control
filtering for the following: %2Windows 7, Windows Server 2008
R2SystemOther System Events64071%Windows 7, Windows Server 2008
R2SystemOther System Events6408Registered product %1 failed and
Windows Firewall is now controlling the filtering for %2Windows 7,
Windows Server 2008 R2
Complete Event MessagesEvent IDDetailed Message4608Windows is
starting up.This event is logged when LSASS.EXE starts and the
auditing subsystem is initialized.4609Windows is shutting down.All
logon sessions will be terminated by this shutdown.4610An
authentication package has been loaded by the Local Security
Authority.This authentication package will be used to authenticate
logon attempts.
Authentication Package Name: %14611This logon process will be
trusted to submit logon requests.
Subject: Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Logon Process Name: %54612Internal resources allocated for the
queuing of audit messages have been exhausted, leading to the loss
of some audits.
Number of audit messages discarded: %1
This event is generated when audit queues are filled and events
must be discarded. This most commonly occurs when security events
are being generated faster than they are being written to disk, or
when the auditing system loses connectivity to the event log, such
as when the event log service is stopped.4614A notification package
has been loaded by the Security Account Manager.This package will
be notified of any account or password changes.
Notification Package Name: %14615Invalid use of LPC port.
Subject: Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Process Information: PID: %7 Name: %8
Invalid Use: %5
LPC Server Port Name: %6
Windows Local Security Authority (LSA) communicates with the
Windows kernel using Local Procedure Call (LPC) ports. If you see
this event, an application has inadvertently or intentionally
accessed this port which is reserved exclusively for LSA's use. The
application (process) should be investigated to ensure that it is
not attempting to tamper with this communications channel.4616The
system time was changed.
Subject: Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Process Information: Process ID: %9 Name: %10
Previous Time: %6 %5New Time: %8 %7
This event is generated when the system time is changed. It is
normal for the Windows Time Service, which runs with System
privilege, to change the system time on a regular basis. Other
system time changes may be indicative of attempts to tamper with
the computer.
Note: Process Information audit data is available only on
computers running Windows Server 2008 R2 or Windows 7.4618A
monitored security event pattern has occurred.
Subject: Security ID: %3 Account Name: %4 Account Domain: %5
Logon ID: %6
Alert Information: Computer: %2 Event ID: %1 Number of Events:
%7 Duration: %8
This event is generated when Windows is configured to generate
alerts in accordance with the Common Criteria Security Audit
Analysis requirements (FAU_SAA) and an auditable event pattern
occurs.4621Administrator recovered system from CrashOnAuditFail.
Users who are not administrators will now be allowed to log on.
Some auditable activity might not have been recorded.
Value of CrashOnAuditFail: %1
This event is logged after a system reboots following
CrashOnAuditFail.4622A security package has been loaded by the
Local Security Authority.
Security Package Name: %14624An account was successfully logged
on.
Subject: Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Logon Type: %9
New Logon: Security ID: %5 Account Name: %6 Account Domain: %7
Logon ID: %8 Logon GUID: %13
Process Information: Process ID: %17 Process Name: %18
Network Information: Workstation Name: %12 Source Network
Address: %19 Source Port: %20
Detailed Authentication Information: Logon Process: %10
Authentication Package: %11 Transited Services: %14 Package Name
(NTLM only): %15 Key Length: %16
This event is generated when a logon session is created. It is
generated on the computer that was accessed.
The subject fields indicate the account on the local system
which requested the logon. This is most commonly a service such as
the Server service, or a local process such as Winlogon.exe or
Services.exe.
The logon type field indicates the kind of logon that occurred.
The most common types are 2 (interactive) and 3 (network).
The New Logon fields indicate the account for whom the new logon
was created, i.e. the account that was logged on.
The network fields indicate where a remote logon request
originated. Workstation name is not always available and may be
left blank in some cases.
The authentication information fields provide detailed
information about this specific logon request. - Logon GUID is a
unique identifier that can be used to correlate this event with a
KDC event. - Transited services indicate which intermediate
services have participated in this logon request. - Package name
indicates which sub-protocol was used among the NTLM protocols. -
Key length indicates the length of the generated session key. This
will be 0 if no session key was requested.4625An account failed to
log on.
Subject: Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Logon Type: %11
Account For Which Logon Failed: Security ID: %5 Account Name: %6
Account Domain: %7
Failure Information: Failure Reason: %9 Status: %8 Sub Status:
%10
Process Information: Caller Process ID: %18 Caller Process Name:
%19
Network Information: Workstation Name: %14 Source Network
Address: %20 Source Port: %21
Detailed Authentication Information: Logon Process: %12
Authentication Package: %13 Transited Services: %15 Package Name
(NTLM only): %16 Key Length: %17
This event is generated when a logon request fails. It is
generated on the computer where access was attempted.
The Subject fields indicate the account on the local system
which requested the logon. This is most commonly a service such as
the Server service, or a local process such as Winlogon.exe or
Services.exe.
The Logon Type field indicates the kind of logon that was
requested. The most common types are 2 (interactive) and 3
(network).
The Process Information fields indicate which account and
process on the system requested the logon.
The Network Information fields indicate where a remote logon
request originated. Workstation name is not always available and
may be left blank in some cases.
The authentication information fields provide detailed
information about this specific logon request. - Transited services
indicate which intermediate services have participated in this
logon request. - Package name indicates which sub-protocol was used
among the NTLM protocols. - Key length indicates the length of the
generated session key. This will be 0 if no session key was
requested.4634An account was logged off.
Subject: Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Logon Type: %5
This event is generated when a logon session is destroyed. It
may be positively correlated with a logon event using the Logon ID
value. Logon IDs are only unique between reboots on the same
computer.46460.014647User initiated logoff:
Subject: Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
This event is generated when a logoff is initiated but the token
reference count is not zero and the logon session cannot be
destroyed. No further user-initiated activity can occur. This event
can be interpreted as a logoff event.4648A logon was attempted
using explicit credentials.
Subject: Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4 Logon GUID: %5
Account Whose Credentials Were Used: Account Name: %6 Account
Domain: %7 Logon GUID: %8
Target Server: Target Server Name: %9 Additional Information:
%10
Process Information: Process ID: %11 Process Name: %12
Network Information: Network Address: %13 Port: %14
This event is generated when a process attempts to log on an
account by explicitly specifying that accounts credentials. This
most commonly occurs in batch-type configurations such as scheduled
tasks, or when using the RUNAS command.4649A replay attack was
detected.
Subject: Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Credentials Which Were Replayed: Account Name: %5 Account
Domain: %6
Process Information: Process ID: %12 Process Name: %13
Network Information: Workstation Name: %10
Detailed Authentication Information: Request Type: %7 Logon
Process: %8 Authentication Package: %9 Transited Services: %11
This event indicates that a Kerberos replay attack was detected-
a request was received twice with identical information. This
condition could be caused by network misconfiguration.4650An IPsec
Main Mode security association was established. Extended Mode was
not enabled. Certificate authentication was not used.
Local Endpoint: Principal Name: %1 Network Address: %3 Keying
Module Port: %4
Remote Endpoint: Principal Name: %2 Network Address: %5 Keying
Module Port: %6
Security Association Information: Lifetime (minutes): %12 Quick
Mode Limit: %13 Main Mode SA ID: %17
Cryptographic Information: Cipher Algorithm: %9 Integrity
Algorithm: %10 Diffie-Hellman Group: %11
Additional Information: Keying Module Name: %7 Authentication
Method: %8 Role: %14 Impersonation State: %15 Main Mode Filter ID:
%164651An IPsec Main Mode security association was established.
Extended Mode was not enabled. A certificate was used for
authentication.
Local Endpoint: Principal Name: %1 Network Address: %9 Keying
Module Port: %10
Local Certificate: SHA Thumbprint: %2 Issuing CA: %3 Root CA:
%4
Remote Endpoint: Principal Name: %5 Network Address: %11 Keying
Module Port: %12
Remote Certificate: SHA thumbprint: %6 Issuing CA: %7 Root CA:
%8
Cryptographic Information: Cipher Algorithm: %15 Integrity
Algorithm: %16 Diffie-Hellman Group: %17
Security Association Information: Lifetime (minutes): %18 Quick
Mode Limit: %19 Main Mode SA ID: %23
Additional Information: Keying Module Name: %13 Authentication
Method: %14 Role: %20 Impersonation State: %21 Main Mode Filter ID:
%224652An IPsec Main Mode negotiation failed.
Local Endpoint: Principal Name: %1 Network Address: %9 Keying
Module Port: %10
Local Certificate: SHA Thumbprint: %2 Issuing CA: %3 Root CA:
%4
Remote Endpoint: Principal Name: %5 Network Address: %11 Keying
Module Port: %12
Remote Certificate: SHA thumbprint: %6 Issuing CA: %7 Root CA:
%8
Additional Information: Keying Module Name: %13 Authentication
Method: %16 Role: %18 Impersonation State: %19 Main Mode Filter ID:
%20
Failure Information: Failure Point: %14 Failure Reason: %15
State: %17 Initiator Cookie: %21 Responder Cookie: %224653An IPsec
Main Mode negotiation failed.
Local Endpoint: Local Principal Name: %1 Network Address: %3
Keying Module Port: %4
Remote Endpoint: Principal Name: %2 Network Address: %5 Keying
Module Port: %6
Additional Information: Keying Module Name: %7 Authentication
Method: %10 Role: %12 Impersonation State: %13 Main Mode Filter ID:
%14
Failure Information: Failure Point: %8 Failure Reason: %9 State:
%11 Initiator Cookie: %15 Responder Cookie: %164654An IPsec Quick
Mode negotiation failed.
Local Endpoint: Network Address: %1 Network Address mask: %2
Port: %3 Tunnel Endpoint: %4
Remote Endpoint: Network Address: %5 Address Mask: %6 Port: %7
Tunnel Endpoint: %8 Private Address: %10
Additional Information: Protocol: %9 Keying Module Name: %11
Virtual Interface Tunnel ID: %20 Traffic Selector ID: %21% Mode:
%14 Role: %16 Quick Mode Filter ID: %18 Main Mode SA ID: %19
Failure Information: State: %15 Message ID: %17 Failure Point:
%12 Failure Reason: %13
Note: Virtual Interface Tunnel ID and Traffic Selector ID data
is available only on computers running Windows Server 2008 R2 or
Windows 7.4655n IPsec Main Mode security association ended.
Local Network Address: %1Remote Network Address: %2Keying Module
Name: %3Main Mode SA ID: %44656A handle to an object was
requested.
Subject: Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Object: Object Server: %5 Object Type: %6 Object Name: %7 Handle
ID: %8
Process Information: Process ID: %14 Process Name: %15
Access Request Information: Transaction ID: %9 Accesses: %10
Access Mask: %11 Privileges Used for Access Check: %12 Restricted
SID Count: %13
Note: Events in this subcategory generate events only for object
types where the corresponding Object Access subcategory is enabled.
For example, if File system object access is enabled, handle
manipulation security audit events are generated. If Registry
object access is not enabled, handle manipulation security audit
events will not be generated.4657A registry value was modified.
Subject: Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Object: Object Name: %5 Object Value Name: %6 Handle ID: %7
Operation Type: %8
Process Information: Process ID: %13 Process Name: %14
Change Information: Old Value Type: %9 Old Value: %10 New Value
Type: %11 New Value: %124658The handle to an object was closed.
Subject : Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Object: Object Server: %5 Handle ID: %6
Process Information: Process ID: %7 Process Name: %84659A handle
to an object was requested with intent to delete.
Subject: Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Object: Object Server: %5 Object Type: %6 Object Name: %7 Handle
ID: %8
Process Information: Process ID: %13
Access Request Information: Transaction ID: %9 Accesses: %10
Access Mask: %11 Privileges Used for Access Check: %124660An object
was deleted.
Subject: Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Object: Object Server: %5 Handle ID: %6
Process Information: Process ID: %7 Process Name: %8 Transaction
ID: %94661A handle to an object was requested.
Subject : Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Object: Object Server: %5 Object Type: %6 Object Name: %7 Handle
ID: %8
Process Information: Process ID: %15 Process Name: %16
Access Request Information: Transaction ID: %9 Accesses: %10
Access Mask: %11 Privileges Used for Access Check: %12 Properties:
%13 Restricted SID Count: %144662An operation was performed on an
object.
Subject : Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Object: Object Server: %5 Object Type: %6 Object Name: %7 Handle
ID: %9
Operation: Operation Type: %8 Accesses: %10 Access Mask: %11
Properties: %12
Additional Information: Parameter 1: %13 Parameter 2: %144663An
attempt was made to access an object.
Subject: Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Object: Object Server: %5 Object Type: %6 Object Name: %7 Handle
ID: %8
Process Information: Process ID: %11 Process Name: %12
Access Request Information: Accesses: %9 Access Mask: %104664An
attempt was made to create a hard link.
Subject: Account Name: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Link Information: File Name: %5 Link Name: %6 Transaction ID:
%74665An attempt was made to create an application client
context.
Subject: Client Name: %3 Client Domain: %4 Client Context ID:
%5
Application Information: Application Name: %1 Application
Instance ID: %2
Status: %64666An application attempted an operation:
Subject: Client Name: %5 Client Domain: %6 Client Context ID:
%7
Object: Object Name: %3 Scope Names: %4
Application Information: Application Name: %1 Application
Instance ID: %2
Access Request Information: Role: %8 Groups: %9 Operation Name:
%10 (%11)4667An application client context was deleted.
Subject: Client Name: %3 Client Domain: %4 Client Context ID:
%5
Application Information: Application Name: %1 Application
Instance ID: %24668An application was initialized.
Subject: Client Name: %3 Client Domain: %4 Client ID: %5
Application Information: Application Name: %1 Application
Instance ID: %2
Additional Information: Policy Store URL: %64670Permissions on
an object were changed.
Subject: Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Object: Object Server: %5 Object Type: %6 Object Name: %7 Handle
ID: %8
Process: Process ID: %11 Process Name: %12
Permissions Change: Original Security Descriptor: %9 New
Security Descriptor: %104671An application attempted to access a
blocked ordinal through the TBS.
Subject: Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Ordinal: %54672Special privileges assigned to new logon.
Subject: Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Privileges: %54673A privileged service was called.
Subject: Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Service: Server: %5 Service Name: %6
Process: Process ID: %8 Process Name: %9
Service Request Information: Privileges: %74674An operation was
attempted on a privileged object.
Subject: Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Object: Object Server: %5 Object Type: %6 Object Name: %7 Object
Handle: %8
Process Information: Process ID: %11 Process Name: %12
Requested Operation: Desired Access: %9 Privileges: %104675SIDs
were filtered.
Target Account: Security ID: %1 Account Name: %2 Account Domain:
%3
Trust Information: Trust Direction: %4 Trust Attributes: %5
Trust Type: %6 TDO Domain SID: %7
Filtered SIDs: %84688A new process has been created.
Subject: Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Process Information: New Process ID: %5 New Process Name: %6
Token Elevation Type: %7 Creator Process ID: %8
Token Elevation Type indicates the type of token that was
assigned to the new process in accordance with User Account Control
policy.
Type 1 is a full token with no privileges removed or groups
disabled. A full token is only used if User Account Control is
disabled or if the user is the built-in Administrator account or a
service account.
Type 2 is an elevated token with no privileges removed or groups
disabled. An elevated token is used when User Account Control is
enabled and the user chooses to start the program using Run as
administrator. An elevated token is also used when an application
is configured to always require administrative privilege or to
always require maximum privilege, and the user is a member of the
Administrators group.
Type 3 is a limited token with administrative privileges removed
and administrative groups disabled. The limited token is used when
User Account Control is enabled, the application does not require
administrative privilege, and the user does not choose to start the
program using Run as administrator.4689A process has exited.
Subject: Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Process Information: Process ID: %6 Process Name: %7 Exit
Status: %54690An attempt was made to duplicate a handle to an
object.
Subject: Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Source Handle Information: Source Handle ID: %5 Source Process
ID: %6
New Handle Information: Target Handle ID: %7 Target Process ID:
%84691Indirect access to an object was requested.
Subject: Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Object: Object Type: %5 Object Name: %6
Process Information: Process ID: %9
Access Request Information: Accesses: %7 Access Mask:
%84692Backup of data protection master key was attempted.
Subject: Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Key Information: Key Identifier: %5 Recovery Server: %6 Recovery
Key ID: %7
Status Information: Status Code: %84693Recovery of data
protection master key was attempted.
Subject: Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Key Information: Key Identifier: %5 Recovery Server: %6 Recovery
Key ID: %8 Recovery Reason: %7
Status Information: Status Code: %94694Protection of auditable
protected data was attempted.
Subject: Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Protected Data: Data Description: %6 Key Identifier: %5
Protected Data Flags: %7 Protection Algorithms: %8
Status Information: Status Code: %94695Unprotection of auditable
protected data was attempted.
Subject: Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Protected Data: Data Description: %6 Key Identifier: %5
Protected Data Flags: %7 Protection Algorithms: %8
Status Information: Status Code: %94696A primary token was
assigned to process.
Subject: Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Process Information: Process ID: %11 Process Name: %12
Target Process: Target Process ID: %9 Target Process Name:
%10
New Token Information: Security ID: %5 Account Name: %6 Account
Domain: %7 Logon ID: %84697A service was installed in the
system.
Subject: Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Service Information: Service Name: %5 Service File Name: %6
Service Type: %7 Service Start Type: %8 Service Account: %94698A
scheduled task was created.
Subject: Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Task Information: Task Name: %5 Task Content: %64699A scheduled
task was deleted.
Subject: Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Task Information: Task Name: %5 Task Content: %64700A scheduled
task was enabled.
Subject: Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Task Information: Task Name: %5 Task Content: %64701A scheduled
task was disabled.
Subject: Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Task Information: Task Name: %5 Task Content: %64702A scheduled
task was updated.
Subject: Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Task Information: Task Name: %5 Task New Content: %64704A user
right was assigned.
Subject: Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Target Account: Account Name: %5
New Right: User Right: %64705A user right was removed.
Subject: Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Target Account: Account Name: %5
Removed Right: User Right: %64706A new trust was created to a
domain.
Subject: Security ID: %3 Account Name: %4 Account Domain: %5
Logon ID: %6
Trusted Domain: Domain Name: %1 Domain ID: %2
Trust Information: Trust Type: %7 Trust Direction: %8 Trust
Attributes: %9 SID Filtering: %104707A trust to a domain was
removed.
Subject: Security ID: %3 Account Name: %4 Account Domain: %5
Logon ID: %6
Domain Information: Domain Name: %1 Domain ID: %24709IPsec
Services was started.
%1
Policy Source: %2
%34710IPsec Services was disabled.
%1%24711%14712IPsec Services encountered a potentially serious
failure.%14713Kerberos policy was changed.
Subject: Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Changes Made:('--' means no changes, otherwise each change is
shown as:(Parameter Name): (new value) (old value))%54714Encrypted
data recovery policy was changed.
Subject: Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Changes Made:('--' means no changes, otherwise each change is
shown as:(Parameter Name): (new value) (old value))%54715The audit
policy (SACL) on an object was changed.
Subject: Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Audit Policy Change: Original Security Descriptor: %5 New
Security Descriptor: %64716Trusted domain information was
modified.
Subject: Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Trusted Domain: Domain Name: %5 Domain ID: %6
New Trust Information: Trust Type: %7 Trust Direction: %8 Trust
Attributes: %9 SID Filtering: %104717System security access was
granted to an account.
Subject: Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Account Modified: Account Name: %5
Access Granted: Access Right: %64718System security access was
removed from an account.
Subject: Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Account Modified: Account Name: %5
Access Removed: Access Right: %64719System audit policy was
changed.
Subject: Security ID: %1 Account Name: %2 Account Domain: %3
Logon ID: %4
Audit Policy Change: Category: %5 Subcategory: %6 Subcategory
GUID: %7 Changes: %84720A user account was created.
Subject: Security ID: %4 Account Name: %5 Account Domain: %6
Logon ID: %7
New Account: Security ID: %3 Account Name: %1 Account Domain:
%2
Attributes: SAM Account Name: %9 Display Name: %10 User
Principal Name: %11 Home Directory: %12 Home Drive: %13 Script
Path: %14 Profile Path: %15 User Workstations: %16 Password Last
Set: %17 Account Expires: %18 Primary Group ID: %19 Allowed To
Delegate To: %20 Old UAC Value: %21 New UAC Value: %22 User Account
Control: %23 User Parameters: %24 SID History: %25 Logon Hours:
%26
Additional Information: Privileges %84722A user account was
enabled.
Subject: Security ID: %4 Account Name: %5 Account Domain: %6
Logon ID: %7
Target Account: Security ID: %3 Account Name: %1 Account Domain:
%24723An attempt was made to change an account's password.
Subject: Security ID: %4 Account Name: %5 Account Domain: %6
Logon ID: %7
Target Account: Security ID: %3 Account Name: %1 Account Domain:
%2
Additional Information: Privileges %84724An attempt was made to
reset an account's password.
Subject: Security ID: %4 Account Name: %5 Account Domain: %6
Logon ID: %7
Target Account: Security ID: %3 Account Name: %1 Account Domain:
%24725A user account was disabled.
Subject: Security ID: %4 Account Name: %5 Account Domain: %6
Logon ID: %7
Target Account: Security ID: %3 Account Name: %1 Account Domain:
%24726A user account was deleted.
Subject: Security ID: %4 Account Name: %5 Account Domain: %6
Logon ID: %7
Target Account: Security ID: %3 Account Name: %1 Account Domain:
%2
Additional Information: Privileges %84727A security-enabled
global group was created.
Subject: Security ID: %4 Account Name: %5 Account Domain: %6
Logon ID: %7
New Group: Security ID: %3 Group Name: %1 Group Domain: %2
Attributes: SAM Account Name: %9 SID History: %10
Additional Information: Privileges: %84728A member was added to
a security-enabled global group.
Subject: Security ID: %6 Account Name: %7 Account Domain: %8
Logon ID: %9
Member: Security ID: %2 Account Name: %1
Group: Security ID: %5 Group Name: %3 Group Domain: %4
Additional Information: Privileges: %104729A member was removed
from a security-enabled global group.
Subject: Security ID: %6 Account Name: %7 Account Domain: %8
Logon ID: %9
Member: Security ID: %2 Account Name: %1
Group: Security ID: %5 Group Name: %3 Group Domain: %4
Additional Information: Privileges: %104730A security-enabled
global group was deleted.
Subject: Security ID: %4 Account Name: %5 Account Domain: %6
Logon ID: %7
Deleted Group: Security ID: %3 Group Name: %1 Group Domain:
%2
Additional Information: Privileges: %84731A security-enabled
local group was created.
Subject: Security ID: %4 Account Name: %5 Account Domain: %6
Logon ID: %7
New Group: Security ID: %3 Group Name: %1 Group Domain: %2
Attributes: SAM Account Name: %9 SID History: %10
Additional Information: Privileges: %84732A member was added to
a security-enabled local group.
Subject: Security ID: %6 Account Name: %7 Account Domain: %8
Logon ID: %9
Member: Security ID: %2 Account Name: %1
Group: Security ID: %5 Group Name: %3 Group Domain: %4
Additional Information: Privileges: %104733A member was removed
from a security-enabled local group.
Subject: Security ID: %6 Account Name: %7 Account Domain: %8
Logon ID: %9
Member: Security ID: %2 Account Name: %1
Group: Security ID: %5 Group Name: %3 Group Domain: %4
Additional Information: Privileges: %104734A security-enabled
local group was deleted.
Subject: Security ID: %4 Account Name: %5 Account Domain: %6
Logon ID: %7
Group: Security ID: %3 Group Name: %1 Group Domain: %2
Additional Information: Privileges: %84735A security-enabled
local group was changed.
Subject: Security ID: %4 Account Name: %5 Account Domain: %6
Logon ID: %7
Group: Security ID: %3 Group Name: %1 Group Domain: %2
Changed Attributes: SAM Account Name: %9 SID History: %10
Additional Information: Privileges: %84737A security-enabled
global group was changed.
Subject: Security ID: %4 Account Name: %5 Account Domain: %6
Logon ID: %7
Group: Security ID: %3 Group Name: %1 Group Domain: %2
Changed Attributes: SAM Account Name: %9 SID History: %10
Additional Information: Privileges: %84738A user account was
changed.
Subject: Security ID: %5 Account Name: %6 Account Domain: %7
Logon ID: %8
Target Account: Security ID: %4 Account Name: %2 Account Domain:
%3
Changed Attributes: SAM Account Name: %10 Display Name: %11 User
Principal Name: %12 Home Directory: %13 Home Drive: %14 Script
Path: %15 Profile Path: %16 User Workstations: %17 Password Last
Set: %18 Account Expires: %19 Primary Group ID: %20
AllowedToDelegateTo: %21 Old UAC Value: %22 New UAC Value: %23 User
Account Control: %24 User Parameters: %25 SID History: %26 Logon
Hours: %27
Additional Information: Privileges: %94739Domain Policy was
changed.
Change Type: %1 modified
Subject: Security ID: %4 Account Name: %5 Account Domain: %6
Logon ID: %7
Domain: Domain Name: %2 Domain ID: %3
Changed Attributes: Min. Password Age: %9 Max. Password Age: %10
Force Logoff: %11 Lockout Threshold: %12 Lockout Observation
Window: %13 Lockout Duration: %14 Password Properties: %15 Min.
Password Length: %16 Password History Length: %17 Machine Account
Quota: %18 Mixed Domain Mode: %19 Domain Behavior Version: %20 OEM
Information: %21
Additional Information: Privileges: %847400x8000000000000000
message: A user account was locked out.
Subject: Security ID: %4 Account Name: %5 Account Domain: %6
Logon ID: %7
Account That Was Locked Out: Security ID: %3 Account Name:
%1
Additional Information: Caller Computer Name: %24741A computer
account was created.
Subject: Security ID: %4 Account Name: %5 Account Domain: %6
Logon ID: %7
New Computer Account: Security ID: %3 Account Name: %1 Account
Domain: %2
Attributes: SAM Account Name: %9 Display Name: %10 User
Principal Name: %11 Home Directory: %12 Home Drive: %13 Script
Path: %14 Profile Path: %15 User Workstations: %16 Password Last
Set: %17 Account Expires: %18 Primary Group ID: %19
AllowedToDelegateTo: %20 Old UAC Value: %21 New UAC Value: %22 User
Account Control: %23 User Parameters: %24 SID History: %25 Logon
Hours: %26 DNS Host Name: %27 Service Principal Names: %28
Additional Information: Privileges %84742A computer account was
changed.
Subject: Security ID: %5 Account Name: %6 Account Domain: %7
Logon ID: %8
Computer Account That Was Changed: Security ID: %4 Account Name:
%2 Account Domain: %3
Changed Attributes: SAM Account Name: %10 Display Name: %11 User
Principal Name: %12 Home Directory: %13 Home Drive: %14 Script
Path: %15 Profile Path: %16 User Workstations: %17 Password Last
Set: %18 Account Expires: %19 Primary Group ID: %20
AllowedToDelegateTo: %21 Old UAC Value: %22 New UAC Value: %23 User
Account Control: %24 User Parameters: %25 SID History: %26 Logon
Hours: %27 DNS Host Name: %28 Service Principal Names: %29
Additional Information: Privileges: %94743A computer account was
deleted.
Subject: Security ID: %4 Account Name: %5 Account Domain: %6
Logon ID: %7
Target Computer: Security ID: %3 Account Name: %1 Account
Domain: %2
Additional Information: Privileges: %84744A security-disabled
local group was created.
Subject: Security ID: %4 Account Name: %5 Account Domain: %6
Logon ID: %7
New Group: Security ID: %3 Group Name: %1 Group Domain: %2
Attributes: SAM Account Name: %9 SID History: %10
Additional Information: Privileges: %84745A security-disabled
local group was changed.
Subject: Security ID: %4 Account Name: %5 Account Domain: %6
Logon ID: %7
Group: Security ID: %3 Group Name: %1 Group Domain: %2
Changed Attributes: SAM Account Name: %9 SID History: %10
Additional Information: Privileges: %84746A member was added to
a security-disabled local group.
Subject: Security ID: %6 Account Name: %7 Account Domain: %8
Logon ID: %9
Member: Security ID: %2 Account Name: %1
Group: Security ID: %5 Group Name: %3 Group Domain: %4
Additional Information: Privileges: %104747A member was removed
from a security-disabled local group.
Subject: Security ID: %6 Account Name: %7 Account Domain: %8
Logon ID: %9
Member: Security ID: %2 Account Name: %1
Group: Security ID: %5 Group Name: %3 Group Domain: %4
Additional Information: Privileges: %104748A security-disabled
local group was deleted.
Subject: Security ID: %4 Account Name: %5 Account Domain: %6
Logon ID: %7
Group: Security ID: %3 Group Name: %1 Group Domain: %2
Additional Information: Privileges: %84749A security-disabled
global group was created.
Subject: Security ID: %4 Account Name: %5 Account Domain: %6
Logon ID: %7
Group: Security ID: %3 Group Name: %1 Group Domain: %2
Attributes: SAM Account Name: %9 SID History: %10
Additional Information: Privileges: %84750A security-disabled
global group was changed.
Subject: Security ID: %4 Account Name: %5 Account Domain: %6
Logon ID: %7
Group: Security ID: %3 Group Name: %1 Group Domain: %2
Changed Attributes: SAM Account Name: %9 SID History: %10
Additional Information: Privileges: %84751A member was added to
a security-disabled global group.
Subject: Security ID: %6 Account Name: %7 Account Domain: %8
Logon ID: %9
Member: Security ID: %2 Account Name: %1
Group: Security ID: %5 Group Name: %3 Group Domain: %4
Additional Information: Privileges: %104752A member was removed
from a security-disabled global group.
Subject: Security ID: %6 Account Name: %7 Account Domain: %8
Logon ID: %9
Member: Security ID: %2 Account Name: %1
Group: Security ID: %5 Group Name: %3 Group Domain: %4
Additional Information: Privileges: %104753A security-disabled
global group was deleted.
Subject: Security ID: %4 Account Name: %5 Account Domain: %6
Logon ID: %7
Group: Security ID: %3 Group Name: %1 Group Domain: %2
Additional Information: Privileges: %84754A security-enabled
universal group was created.
Subject: Security ID: %4 Account Name: %5 Account Domain: %6
Logon ID: %7
Group: Security ID: %3 Group Name: %1 Group Domain: %2
Attributes: SAM Account Name: %9 SID History: %10
Additional Information: Privileges: %84755A security-enabled
universal group was changed.
Subject: Security ID: %4 Account Name: %5 Account Domain: %6
Logon ID: %7
Group: Security ID: %3 Group Name: %1 Group Domain: %2
Changed Attributes: SAM Account Name: %9 SID History: %10
Additional Information: Privileges: %84756A member was added to
a security-enabled universal group.
Subject: Security ID: %6 Account Name: %7 Account Domain: %8
Logon ID: %9
Member: Security ID: %2 Account Name: %1
Group: Security ID: %5 Account Name: %3 Account Domain: %4
Additional Information: Privileges: %104757A member was removed
from a security-enabled universal group.
Subject: Security ID: %6 Account Name: %7 Account Domain: %8
Logon ID: %9
Member: Security ID: %2 Account Name: %1
Group: Security ID: %5 Group Name: %3 Group Domain: %4
Additional Information: Privileges: %104758A security-enabled
universal group was deleted.
Subject: Security ID: %4 Account Name: %5 Account Domain: %6
Logon ID: %7
Group: Security ID: %3 Group Name: %1 Group Domain: %2
Additional Information: Privileges: %84759A security-disabled
universal group was created.
Subject: Security ID: %4 Account Name: %5 Account Domain: %6
Logon ID: %7
Group: Security ID: %3 Group Name: %1 Group Domain: %2
Attributes: SAM Account Name: %9 SID History: %10
Additional Information: Privileges: %84760A security-disabled
universal group was changed.
Subject: Security ID: %4 Account Name: %5 Account Domain: %6
Logon ID: %7
Group: Security ID: %3 Group Name: %1 Group Domain: %2
Changed Attributes: SAM Account Name: %9 SID History: %10
Additional Information: Privileges: %84761A member was added to
a security-disabled universal group.
Subject: Security ID: %6 Account Name: %7 Account Domain: %8
Logon ID: %9
Member: Security ID: %2 Account Name: %1
Group: Security ID: %5 Group Name: %3 Group Domain: %4
Additional Information: Privileges: %104762A member was removed
from a security-disabled univ