Forum
Ultimate Windows Security Forum
Forums
Topics
Replies
Last Post
IT Audit
IT Audit discussions and Q&A for specific Microsoft technologies
10
29
3/16/2010 8:58:10 PM
In: RE: Privileged access
By RandyFranklinSmith
Security Log
Get your questions answered about the Windows Security Log
65
145
3/18/2010 12:55:43 PM
In: Workstation Names in LOG
By Darryl
Windows Security Settings
Got a question about a specific Windows security setting? Ask it here.
0
0
Training Course Forums
Resend Validation Email
|
Mark All as Read
|
Delete Forum Cookies
Forum Key
Moderated forum (New Posts)
Normal Forum (New Posts)
Moderated forum
Normal Forum
Redirect forum
Closed forum (No new posts allowed)
Forum Jump...
----------------
Forum Home
Search
Members List
Calendar
Who's Online
----------------
Ultimate Windows Security Forum
|-- IT Audit
|---- Active Directory
|---- Windows Server
|---- SharePoint
|---- SQL Server
|-- Security Log
|---- 512 - Windows NT is starting up
|---- 513 - Windows is shutting down
|---- 514 - An authentication package has been...
|---- 515 - A trusted logon process has registered...
|---- 516 - Internal resources allocated for the...
|---- 517 - The audit log was cleared
|---- 518 - A notification package has been loaded...
|---- 519 - A process is using an invalid local...
|---- 520 - The system time was changed
|---- 528 - Successful Logon
|---- 529 - Logon Failure - Unknown user name or...
|---- 530 - Logon Failure - Account logon time...
|---- 531 - Logon Failure - Account currently...
|---- 532 - Logon Failure - The specified user...
|---- 533 - Logon Failure - User not allowed to...
|---- 534 - Logon Failure - The user has not been...
|---- 535 - Logon Failure - The specified account's...
|---- 536 - Logon Failure - The NetLogon component...
|---- 537 - Logon failure - The logon attempt...
|---- 538 - User Logoff
|---- 539 - Logon Failure - Account locked out
|---- 540 - Successful Network Logon
|---- 552 - Logon attempt using explicit...
|---- 560 - Object Open
|---- 561 - Handle Allocated
|---- 562 - Handle Closed
|---- 563 - Object Open for Delete
|---- 564 - Object Deleted
|---- 565 - Object Open (Active Directory)
|---- 566 - Object Operation (W3 Active Directory)
|---- 567 - Object Access Attempt
|---- 576 - Special privileges assigned to new...
|---- 577 - Privileged Service Called
|---- 578 - Privileged object operation
|---- 592 - A new process has been created
|---- 593 - A process has exited
|---- 594 - A handle to an object has been...
|---- 595 - Indirect access to an object has been...
|---- 600 - A process was assigned a primary token
|---- 601 - Attempt to install service
|---- 602 - Scheduled Task created
|---- 608 - User Right Assigned
|---- 609 - User Right Removed
|---- 610 - New Trusted Domain
|---- 611 - Removing Trusted Domain
|---- 612 - Audit Policy Change
|---- 613 - IPSec policy agent started
|---- 614 - IPSec policy agent disabled
|---- 615 - IPSEC PolicyAgent Service
|---- 616 - IPSec policy agent encountered a...
|---- 617 - Kerberos Policy Changed
|---- 618 - Encrypted Data Recovery Policy Changed
|---- 619 - Quality of Service Policy Changed
|---- 620 - Trusted Domain Information Modified
|---- 621 - System Security Access Granted
|---- 622 - System Security Access Removed
|---- 623 - Per User Audit Policy was refreshed
|---- 624 - User Account Created
|---- 625 - User Account Type Changed
|---- 626 - User Account Enabled
|---- 627 - Change Password Attempt
|---- 628 - User Account password set
|---- 629 - User Account Disabled
|---- 630 - User Account Deleted
|---- 631 - Security Enabled Global Group Created
|---- 632 - Security Enabled Global Group Member...
|---- 633 - Security Enabled Global Group Member...
|---- 634 - Security Enabled Global Group Deleted
|---- 635 - Security Enabled Local Group Created
|---- 636 - Security Enabled Local Group Member...
|---- 637 - Security Enabled Local Group Member...
|---- 638 - Security Enabled Local Group Deleted
|---- 639 - Security Enabled Local Group Changed
|---- 640 - General Account Database Change
|---- 641 - Security Enabled Global Group Changed
|---- 642 - User Account Changed
|---- 643 - Domain Policy Changed
|---- 644 - User Account Locked Out
|---- 645 - Computer Account Created
|---- 646 - Computer Account Changed
|---- 647 - Computer Account Deleted
|---- 648 - Security Disabled Local Group Created
|---- 649 - Security Disabled Local Group Changed
|---- 650 - Security Disabled Local Group Member...
|---- 651 - Security Disabled Local Group Member...
|---- 652 - Security Disabled Local Group Deleted
|---- 653 - Security Disabled Global Group Created
|---- 654 - Security Disabled Global Group Changed
|---- 655 - Security Disabled Global Group Member...
|---- 656 - Security Disabled Global Group Member...
|---- 657 - Security Disabled Global Group Deleted
|---- 658 - Security Enabled Universal Group...
|---- 659 - Security Enabled Universal Group...
|---- 660 - Security Enabled Universal Group Member...
|---- 661 - Security Enabled Universal Group Member...
|---- 662 - Security Enabled Universal Group...
|---- 663 - Security Disabled Universal Group...
|---- 664 - Security Disabled Universal Group...
|---- 665 - Security Disabled Universal Group...
|---- 666 - Security Disabled Universal Group...
|---- 667 - Security Disabled Universal Group...
|---- 668 - Group Type Changed
|---- 669 - Add SID History
|---- 670 - Add SID History
|---- 671 - User Account Unlocked
|---- 672 - Authentication Ticket Granted
|---- 673 - Service Ticket Granted
|---- 674 - Ticket Granted Renewed
|---- 675 - Pre-authentication failed
|---- 676 - Authentication Ticket Request Failed
|---- 677 - Service Ticket Request Failed
|---- 678 - Account Mapped for Logon by
|---- 679 - The name: %2 could not be mapped for...
|---- 680 - Account Used for Logon by
|---- 681 - The logon to account: %2 by: %1 from...
|---- 682 - Session reconnected to winstation
|---- 683 - Session disconnected from winstation
|---- 684 - Set ACLs of members in administrators...
|---- 685 - Account Name Changed
|---- 686 - Password of the following user accessed...
|---- 687 - Basic Application Group Created
|---- 688 - Basic Application Group Changed
|---- 689 - Basic Application Group Member Added
|---- 690 - Basic Application Group Member Removed
|---- 691 - Basic Application Group Non-Member...
|---- 692 - Basic Application Group Non-Member...
|---- 693 - Basic Application Group Deleted
|---- 694 - LDAP Query Group Created
|---- 695 - LDAP Query Group Changed
|---- 696 - LDAP Query Group Deleted
|---- 697 - Password Policy Checking API is called...
|---- 806 - Per User Audit Policy was refreshed
|---- 807 - Per user auditing policy set for user
|---- 1100 - The event logging service has shut...
|---- 1101 - Audit events have been dropped by the...
|---- 1102 - The audit log was cleared
|---- 1104 - The security Log is now full
|---- 1105 - Event log automatic backup
|---- 1108 - The event logging service encountered...
|---- 4608 - Windows is starting up
|---- 4609 - Windows is shutting down
|---- 4610 - An authentication package has been...
|---- 4611 - A trusted logon process has been...
|---- 4612 - Internal resources allocated for the...
|---- 4614 - A notification package has been loaded...
|---- 4615 - Invalid use of LPC port
|---- 4616 - The system time was changed.
|---- 4618 - A monitored security event pattern has...
|---- 4621 - Administrator recovered system from...
|---- 4622 - A security package has been loaded by...
|---- 4624 - An account was successfully logged on
|---- 4625 - An account failed to log on
|---- 4634 - An account was logged off
|---- 4646 - 1.00%
|---- 4647 - User initiated logoff
|---- 4648 - A logon was attempted using explicit...
|---- 4649 - A replay attack was detected
|---- 4650 - An IPsec Main Mode security...
|---- 4651 - An IPsec Main Mode security...
|---- 4652 - An IPsec Main Mode negotiation failed
|---- 4653 - An IPsec Main Mode negotiation failed
|---- 4654 - An IPsec Quick Mode negotiation failed...
|---- 4655 - An IPsec Main Mode security...
|---- 4656 - A handle to an object was requested
|---- 4657 - A registry value was modified
|---- 4658 - The handle to an object was closed
|---- 4659 - A handle to an object was requested...
|---- 4660 - An object was deleted
|---- 4661 - A handle to an object was requested
|---- 4662 - An operation was performed on an...
|---- 4663 - An attempt was made to access an...
|---- 4664 - An attempt was made to create a hard...
|---- 4665 - An attempt was made to create an...
|---- 4666 - An application attempted an operation
|---- 4667 - An application client context was...
|---- 4668 - An application was initialized
|---- 4670 - Permissions on an object were changed
|---- 4671 - An application attempted to access a...
|---- 4672 - Special privileges assigned to new...
|---- 4673 - A privileged service was called
|---- 4674 - An operation was attempted on a...
|---- 4675 - SIDs were filtered
|---- 4685 - The state of a transaction has changed...
|---- 4688 - A new process has been created
|---- 4689 - A process has exited
|---- 4690 - An attempt was made to duplicate a...
|---- 4691 - Indirect access to an object was...
|---- 4692 - Backup of data protection master key...
|---- 4693 - Recovery of data protection master key...
|---- 4694 - Protection of auditable protected data...
|---- 4695 - Unprotection of auditable protected...
|---- 4696 - A primary token was assigned to...
|---- 4697 - A service was installed in the system
|---- 4698 - A scheduled task was created
|---- 4699 - A scheduled task was deleted
|---- 4700 - A scheduled task was enabled
|---- 4701 - A scheduled task was disabled
|---- 4702 - A scheduled task was updated
|---- 4704 - A user right was assigned
|---- 4705 - A user right was removed
|---- 4706 - A new trust was created to a domain
|---- 4707 - A trust to a domain was removed
|---- 4709 - IPsec Services was started
|---- 4710 - IPsec Services was disabled
|---- 4711 - PAStore Engine (1%)
|---- 4712 - IPsec Services encountered a...
|---- 4713 - Kerberos policy was changed
|---- 4714 - Encrypted data recovery policy was...
|---- 4715 - The audit policy (SACL) on an object...
|---- 4716 - Trusted domain information was...
|---- 4717 - System security access was granted to...
|---- 4718 - System security access was removed...
|---- 4719 - System audit policy was changed
|---- 4720 - A user account was created
|---- 4722 - A user account was enabled
|---- 4723 - An attempt was made to change an...
|---- 4724 - An attempt was made to reset an...
|---- 4725 - A user account was disabled
|---- 4726 - A user account was deleted
|---- 4727 - A security-enabled global group was...
|---- 4728 - A member was added to a...
|---- 4729 - A member was removed from a...
|---- 4730 - A security-enabled global group was...
|---- 4731 - A security-enabled local group was...
|---- 4732 - A member was added to a...
|---- 4733 - A member was removed from a...
|---- 4734 - A security-enabled local group was...
|---- 4735 - A security-enabled local group was...
|---- 4737 - A security-enabled global group was...
|---- 4738 - A user account was changed
|---- 4739 - Domain Policy was changed
|---- 4740 - A user account was locked out
|---- 4741 - A computer account was created
|---- 4742 - A computer account was changed
|---- 4743 - A computer account was deleted
|---- 4744 - A security-disabled local group was...
|---- 4745 - A security-disabled local group was...
|---- 4746 - A member was added to a...
|---- 4747 - A member was removed from a...
|---- 4748 - A security-disabled local group was...
|---- 4749 - A security-disabled global group was...
|---- 4750 - A security-disabled global group was...
|---- 4751 - A member was added to a...
|---- 4752 - A member was removed from a...
|---- 4753 - A security-disabled global group was...
|---- 4754 - A security-enabled universal group was...
|---- 4755 - A security-enabled universal group was...
|---- 4756 - A member was added to a...
|---- 4757 - A member was removed from a...
|---- 4758 - A security-enabled universal group was...
|---- 4759 - A security-disabled universal group...
|---- 4760 - A security-disabled universal group...
|---- 4761 - A member was added to a...
|---- 4762 - A member was removed from a...
|---- 4763 - A security-disabled universal group...
|---- 4764 - A groups type was changed
|---- 4765 - SID History was added to an account
|---- 4766 - An attempt to add SID History to an...
|---- 4767 - A user account was unlocked
|---- 4768 - A Kerberos authentication ticket (TGT)...
|---- 4769 - A Kerberos service ticket was...
|---- 4770 - A Kerberos service ticket was renewed
|---- 4771 - Kerberos pre-authentication failed
|---- 4772 - A Kerberos authentication ticket...
|---- 4773 - A Kerberos service ticket request...
|---- 4774 - An account was mapped for logon
|---- 4775 - An account could not be mapped for...
|---- 4776 - The domain controller attempted to...
|---- 4777 - The domain controller failed to...
|---- 4778 - A session was reconnected to a Window...
|---- 4779 - A session was disconnected from a...
|---- 4780 - The ACL was set on accounts which are...
|---- 4781 - The name of an account was changed
|---- 4782 - The password hash an account was...
|---- 4783 - A basic application group was created
|---- 4784 - A basic application group was changed
|---- 4785 - A member was added to a basic...
|---- 4786 - A member was removed from a basic...
|---- 4787 - A non-member was added to a basic...
|---- 4788 - A non-member was removed from a basic...
|---- 4789 - A basic application group was deleted
|---- 4790 - An LDAP query group was created
|---- 4791 - A basic application group was changed
|---- 4792 - An LDAP query group was deleted
|---- 4793 - The Password Policy Checking API was...
|---- 4794 - An attempt was made to set the...
|---- 4800 - The workstation was locked
|---- 4801 - The workstation was unlocked
|---- 4802 - The screen saver was invoked
|---- 4803 - The screen saver was dismissed
|---- 4816 - RPC detected an integrity violation...
|---- 4864 - A namespace collision was detected
|---- 4865 - A trusted forest information entry was...
|---- 4866 - A trusted forest information entry was...
|---- 4867 - A trusted forest information entry was...
|---- 4868 - The certificate manager denied a...
|---- 4869 - Certificate Services received a...
|---- 4870 - Certificate Services revoked a...
|---- 4871 - Certificate Services received a...
|---- 4872 - Certificate Services published the...
|---- 4873 - A certificate request extension...
|---- 4875 - Certificate Services received a...
|---- 4876 - Certificate Services backup started
|---- 4877 - Certificate Services backup completed
|---- 4878 - Certificate Services restore started
|---- 4879 - Certificate Services restore completed...
|---- 4880 - Certificate Services started
|---- 4881 - Certificate Services stopped
|---- 4882 - The security permissions for...
|---- 4883 - Certificate Services retrieved an...
|---- 4884 - Certificate Services imported a...
|---- 4885 - The audit filter for Certificate...
|---- 4886 - Certificate Services received a...
|---- 4887 - Certificate Services approved a...
|---- 4888 - Certificate Services denied a...
|---- 4889 - Certificate Services set the status of...
|---- 4891 - A configuration entry changed in...
|---- 4892 - A property of Certificate Services...
|---- 4893 - Certificate Services archived a key
|---- 4894 - Certificate Services imported and...
|---- 4895 - Certificate Services published the CA...
|---- 4896 - One or more rows have been deleted...
|---- 4897 - Role separation enabled
|---- 4898 - Certificate Services loaded a template...
|---- 4899 - A Certificate Services template was...
|---- 4900 - Certificate Services template security...
|---- 4902 - The Per-user audit policy table was...
|---- 4904 - An attempt was made to register a...
|---- 4905 - An attempt was made to unregister a...
|---- 4906 - The CrashOnAuditFail value has changed...
|---- 4907 - Auditing settings on object were...
|---- 4908 - Special Groups Logon table modified
|---- 4909 - The local policy settings for the TBS...
|---- 4910 - The group policy settings for the TBS...
|---- 4912 - Per User Audit Policy was changed
|---- 4928 - An Active Directory replica source...
|---- 4929 - An Active Directory replica source...
|---- 4930 - An Active Directory replica source...
|---- 4931 - An Active Directory replica...
|---- 4932 - Synchronization of a replica of an...
|---- 4933 - Synchronization of a replica of an...
|---- 4934 - Attributes of an Active Directory...
|---- 4935 - Replication failure begins
|---- 4936 - Replication failure ends
|---- 4937 - A lingering object was removed from a...
|---- 4944 - The following policy was active when...
|---- 4945 - A rule was listed when the Windows...
|---- 4946 - A change has been made to Windows...
|---- 4947 - A change has been made to Windows...
|---- 4948 - A change has been made to Windows...
|---- 4949 - Windows Firewall settings were...
|---- 4950 - A Windows Firewall setting has changed...
|---- 4951 - A rule has been ignored because its...
|---- 4952 - Parts of a rule have been ignored...
|---- 4953 - A rule has been ignored by Windows...
|---- 4954 - Windows Firewall Group Policy settings...
|---- 4956 - Windows Firewall has changed the...
|---- 4957 - Windows Firewall did not apply the...
|---- 4958 - Windows Firewall did not apply the...
|---- 4960 - IPsec dropped an inbound packet that...
|---- 4961 - IPsec dropped an inbound packet that...
|---- 4962 - IPsec dropped an inbound packet that...
|---- 4963 - IPsec dropped an inbound clear text...
|---- 4964 - Special groups have been assigned to a...
|---- 4965 - IPsec received a packet from a remote...
|---- 4976 - During Main Mode negotiation, IPsec...
|---- 4977 - During Quick Mode negotiation, IPsec...
|---- 4978 - During Extended Mode negotiation,...
|---- 4979 - IPsec Main Mode and Extended Mode...
|---- 4980 - IPsec Main Mode and Extended Mode...
|---- 4981 - IPsec Main Mode and Extended Mode...
|---- 4982 - IPsec Main Mode and Extended Mode...
|---- 4983 - An IPsec Extended Mode negotiation...
|---- 4984 - An IPsec Extended Mode negotiation...
|---- 4985 - The state of a transaction has changed...
|---- 5024 - The Windows Firewall Service has...
|---- 5025 - The Windows Firewall Service has been...
|---- 5027 - The Windows Firewall Service was...
|---- 5028 - The Windows Firewall Service was...
|---- 5029 - The Windows Firewall Service failed to...
|---- 5030 - The Windows Firewall Service failed to...
|---- 5031 - The Windows Firewall Service blocked...
|---- 5032 - Windows Firewall was unable to notify...
|---- 5033 - The Windows Firewall Driver has...
|---- 5034 - The Windows Firewall Driver has been...
|---- 5035 - The Windows Firewall Driver failed to...
|---- 5037 - The Windows Firewall Driver detected...
|---- 5038 - Code integrity determined that the...
|---- 5039 - A registry key was virtualized.
|---- 5040 - A change has been made to IPsec...
|---- 5041 - A change has been made to IPsec...
|---- 5042 - A change has been made to IPsec...
|---- 5043 - A change has been made to IPsec...
|---- 5044 - A change has been made to IPsec...
|---- 5045 - A change has been made to IPsec...
|---- 5046 - A change has been made to IPsec...
|---- 5047 - A change has been made to IPsec...
|---- 5048 - A change has been made to IPsec...
|---- 5049 - An IPsec Security Association was...
|---- 5050 - An attempt to programmatically disable...
|---- 5051 - A file was virtualized
|---- 5056 - A cryptographic self test was...
|---- 5057 - A cryptographic primitive operation...
|---- 5058 - Key file operation
|---- 5059 - Key migration operation
|---- 5060 - Verification operation failed
|---- 5061 - Cryptographic operation
|---- 5062 - A kernel-mode cryptographic self test...
|---- 5063 - A cryptographic provider operation was...
|---- 5064 - A cryptographic context operation was...
|---- 5065 - A cryptographic context modification...
|---- 5066 - A cryptographic function operation was...
|---- 5067 - A cryptographic function modification...
|---- 5068 - A cryptographic function provider...
|---- 5069 - A cryptographic function property...
|---- 5070 - A cryptographic function property...
|---- 5120 - OCSP Responder Service Started
|---- 5121 - OCSP Responder Service Stopped
|---- 5122 - A Configuration entry changed in the...
|---- 5123 - A configuration entry changed in the...
|---- 5124 - A security setting was updated on OCSP...
|---- 5125 - A request was submitted to OCSP...
|---- 5126 - Signing Certificate was automatically...
|---- 5127 - The OCSP Revocation Provider...
|---- 5136 - A directory service object was...
|---- 5137 - A directory service object was created...
|---- 5138 - A directory service object was...
|---- 5139 - A directory service object was moved
|---- 5140 - A network share object was accessed
|---- 5141 - A directory service object was deleted...
|---- 5152 - The Windows Filtering Platform blocked...
|---- 5153 - A more restrictive Windows Filtering...
|---- 5154 - The Windows Filtering Platform has...
|---- 5155 - The Windows Filtering Platform has...
|---- 5156 - The Windows Filtering Platform has...
|---- 5157 - The Windows Filtering Platform has...
|---- 5158 - The Windows Filtering Platform has...
|---- 5159 - The Windows Filtering Platform has...
|---- 5376 - Credential Manager credentials were...
|---- 5377 - Credential Manager credentials were...
|---- 5378 - The requested credentials delegation...
|---- 5440 - The following callout was present when...
|---- 5441 - The following filter was present when...
|---- 5442 - The following provider was present...
|---- 5443 - The following provider context was...
|---- 5444 - The following sub-layer was present...
|---- 5446 - A Windows Filtering Platform callout...
|---- 5447 - A Windows Filtering Platform filter...
|---- 5448 - A Windows Filtering Platform provider...
|---- 5449 - A Windows Filtering Platform provider...
|---- 5450 - A Windows Filtering Platform sub-layer...
|---- 5451 - An IPsec Quick Mode security...
|---- 5452 - An IPsec Quick Mode security...
|---- 5453 - An IPsec negotiation with a remote...
|---- 5456 - PAStore Engine applied Active...
|---- 5457 - PAStore Engine failed to apply Active...
|---- 5458 - PAStore Engine applied locally cached...
|---- 5459 - PAStore Engine failed to apply locally...
|---- 5460 - PAStore Engine applied local registry...
|---- 5461 - PAStore Engine failed to apply local...
|---- 5462 - PAStore Engine failed to apply some...
|---- 5463 - PAStore Engine polled for changes to...
|---- 5464 - PAStore Engine polled for changes to...
|---- 5465 - PAStore Engine received a control for...
|---- 5466 - PAStore Engine polled for changes to...
|---- 5467 - PAStore Engine polled for changes to...
|---- 5468 - PAStore Engine polled for changes to...
|---- 5471 - PAStore Engine loaded local storage...
|---- 5472 - PAStore Engine failed to load local...
|---- 5473 - PAStore Engine loaded directory...
|---- 5474 - PAStore Engine failed to load...
|---- 5477 - PAStore Engine failed to add quick...
|---- 5478 - IPsec Services has started...
|---- 5479 - IPsec Services has been shut down...
|---- 5480 - IPsec Services failed to get the...
|---- 5483 - IPsec Services failed to initialize...
|---- 5484 - IPsec Services has experienced a...
|---- 5485 - IPsec Services failed to process some...
|---- 5632 - A request was made to authenticate to...
|---- 5633 - A request was made to authenticate to...
|---- 5712 - A Remote Procedure Call (RPC) was...
|---- 5888 - An object in the COM+ Catalog was...
|---- 5889 - An object was deleted from the COM+...
|---- 5890 - An object was added to the COM+...
|---- 6144 - Security policy in the group policy...
|---- 6145 - One or more errors occured while...
|---- 6272 - Network Policy Server granted access...
|---- 6273 - Network Policy Server denied access to...
|---- 6274 - Network Policy Server discarded the...
|---- 6275 - Network Policy Server discarded the...
|---- 6276 - Network Policy Server quarantined a...
|---- 6277 - Network Policy Server granted access...
|---- 6278 - Network Policy Server granted full...
|---- 6279 - Network Policy Server locked the user...
|---- 6280 - Network Policy Server unlocked the...
|-- Windows Security Settings
Training Course Forums
All times are GMT -5:00, Time now is 11:25am
Upcoming Webinars
Patching Adobe Software: Tips, Secrets and Solutions
Security Log Exposed: Understanding Kerberos Authentication Events and Separating Malicious Events from Noise
Top 5 Security Management Pitfalls with SharePoint
Lack of Accountability in Access Management: Root Cause of Audit Findings and Compliance Problems
Additional Resources
Security Log Quick Reference Chart
Learn about the SharePoint Audit Log
Security Log Resource Kit
Patch Tuesday Analysis
Home
>
Forum
User name:
Password:
/
Forgot?
Register
Home
