Forum

Ultimate Windows Security Forum » Security Log

Security Log

Forums

Topics

Replies

Last Post

512 - Windows NT is starting up

513 - Windows is shutting down

514 - An authentication package has been loaded by the Local Security Authority

6/15/2018 3:33:45 PM

In: RE: 14 - An authentication...

By Hpprintersupport

515 - A trusted logon process has registered with the Local Security Authority

4/7/2016 7:58:29 AM

In: RE: event id 515 dcomscm

By derekthomas

516 - Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits

517 - The audit log was cleared

2/24/2019 1:47:09 PM

In: RE: What is meant by...

By derekthomas

518 - A notification package has been loaded by the Security Account Manager

8/7/2015 2:23:18 PM

In: Replica orologi Omega -...

By emobilemobile

519 - A process is using an invalid local procedure call (LPC) port

520 - The system time was changed

521 - Unable to log events to security log

7/22/2018 6:12:45 PM

In: RE: Security Log not recording...

By derekthomas

528 - Successful Logon

1/21/2018 2:53:12 PM

In: RE: Remote Interactive Login...

By derekthomas

529 - Logon Failure - Unknown user name or bad password

2 days ago @ 3:32:18 PM

In: RE: EventID 4771 Audit Failure...

By Pictogrram

530 - Logon Failure - Account logon time restriction violation

531 - Logon Failure - Account currently disabled

3/10/2011 4:50:58 PM

In: Logon failure cause by svchost...

By cportuguez

532 - Logon Failure - The specified user account has expired

533 - Logon Failure - User not allowed to logon at this computer

534 - Logon Failure - The user has not been granted the requested logon type at this machine

535 - Logon Failure - The specified account's password has expired

11/8/2016 4:26:32 PM

In: RE: Expired passwords

By derekthomas

536 - Logon Failure - The NetLogon component is not active

537 - Logon failure - The logon attempt failed for other reasons.

7/8/2010 9:11:26 AM

In: Event : 537 - Blank user name

By RandyFranklinSmith

538 - User Logoff

11/7/2009 7:59:20 AM

In: RE: Logon type 7

By RandyFranklinSmith

539 - Logon Failure - Account locked out

7/12/2011 4:53:31 PM

In: RE: Domain Account is being...

By RandyFranklinSmith

540 - Successful Network Logon

2/14/2014 8:44:36 PM

In: RE: 2003 RDP sessions

By brucemcclane

551 - User initiated logoff

552 - Logon attempt using explicit credentials

6/20/2012 2:45:39 PM

In: RE: Trying to find the user...

By whsmith

560 - Object Open

6/8/2017 5:29:35 PM

In: RE: Primary Logon...

By derekthomas

561 - Handle Allocated

6/29/2012 1:58:48 PM

In: RE: Event id for File Copy

By whsmith

562 - Handle Closed

563 - Object Open for Delete

564 - Object Deleted

2/10/2011 10:15:16 AM

In: RE: How to determine and...

By RandyFranklinSmith

565 - Object Open (Active Directory)

12/22/2013 4:18:29 PM

In: RE: Audit RDP connections on...

By derekthomas

566 - Object Operation (W3 Active Directory)

2/20/2012 4:22:50 PM

In: RE: Event ID 566 why?

By whsmith

567 - Object Access Attempt

7/8/2011 11:06:31 AM

In: RE: Tracking Rename using...

By RandyFranklinSmith

576 - Special privileges assigned to new logon

8/17/2015 7:05:33 PM

In: Daytona Cosmograph

By tewettcels

577 - Privileged Service Called

11/11/2010 11:46:32 AM

In: RE: Query regarding event id...

By RandyFranklinSmith

578 - Privileged object operation

7/3/2014 3:13:38 PM

In: Effects?

By lmieth

592 - A new process has been created

2/28/2014 9:45:47 AM

In: Monitoring Processes

By cliron

593 - A process has exited

594 - A handle to an object has been duplicated

595 - Indirect access to an object has been obtained

596 - Backup of data protection master key

600 - A process was assigned a primary token

601 - Attempt to install service

602 - Scheduled Task created

608 - User Right Assigned

609 - User Right Removed

610 - New Trusted Domain

9/8/2015 10:40:28 AM

In: レプリカウブロの時計

By irconiamad

611 - Removing Trusted Domain

612 - Audit Policy Change

3/8/2011 6:28:30 AM

In: RE: Differentiate Between...

By RandyFranklinSmith

613 - IPSec policy agent started

614 - IPSec policy agent disabled

615 - IPSEC PolicyAgent Service

616 - IPSec policy agent encountered a potentially serious failure.

617 - Kerberos Policy Changed

618 - Encrypted Data Recovery Policy Changed

619 - Quality of Service Policy Changed

620 - Trusted Domain Information Modified

621 - System Security Access Granted

622 - System Security Access Removed

623 - Per User Audit Policy was refreshed

624 - User Account Created

3/11/2016 3:19:06 AM

In: RE: New Users - No 624 event...

By turkishce

625 - User Account Type Changed

626 - User Account Enabled

627 - Change Password Attempt

4/23/2012 1:02:40 PM

In: RE: how to invoke...

By whsmith

628 - User Account password set

8/28/2010 5:02:52 PM

In: RE: Event ID 628: Password...

By RandyFranklinSmith

629 - User Account Disabled

4/10/2012 8:27:45 PM

In: RE: Source Hostname

By whsmith

630 - User Account Deleted

3/10/2010 5:27:03 PM

In: RE: Deleting account by...

By RandyFranklinSmith

631 - Security Enabled Global Group Created

632 - Security Enabled Global Group Member Added

11/4/2009 10:24:46 AM

In: RE: Modifying SID history...

By RandyFranklinSmith

633 - Security Enabled Global Group Member Removed

634 - Security Enabled Global Group Deleted

635 - Security Enabled Local Group Created

3/24/2012 3:35:51 PM

In: RE: Local security groups -...

By cportuguez

636 - Security Enabled Local Group Member Added

10/11/2011 6:24:26 AM

In: RE: EventID 636, missing...

By JavierC

637 - Security Enabled Local Group Member Removed

3/24/2013 9:21:32 PM

In: RE: Member '-' removed from...

By whsmith

638 - Security Enabled Local Group Deleted

639 - Security Enabled Local Group Changed

640 - General Account Database Change

641 - Security Enabled Global Group Changed

642 - User Account Changed

9/15/2015 12:06:53 PM

In: Retrieving full text of event...

By LHuisingh

643 - Domain Policy Changed

644 - User Account Locked Out

10/3/2012 10:06:43 PM

In: RE: Tracking bad password...

By whsmith

645 - Computer Account Created

125

10/16/2015 1:28:17 AM

In: Links of London Outlet Store...

By keglucksmdelp

646 - Computer Account Changed

4/26/2012 11:45:04 PM

In: RE: what constitutes a change

By whsmith

647 - Computer Account Deleted

648 - Security Disabled Local Group Created

9/21/2009 8:12:13 AM

In: What is caller user name in...

By RandyFranklinSmith

649 - Security Disabled Local Group Changed

650 - Security Disabled Local Group Member Added

651 - Security Disabled Local Group Member Removed

652 - Security Disabled Local Group Deleted

653 - Security Disabled Global Group Created

5/3/2011 5:49:48 AM

In: RE: Is there any reason to...

By RandyFranklinSmith

654 - Security Disabled Global Group Changed

655 - Security Disabled Global Group Member Added

656 - Security Disabled Global Group Member Removed

657 - Security Disabled Global Group Deleted

658 - Security Enabled Universal Group Created

659 - Security Enabled Universal Group Changed

660 - Security Enabled Universal Group Member Added

661 - Security Enabled Universal Group Member Removed

662 - Security Enabled Universal Group Deleted

663 - Security Disabled Universal Group Created

664 - Security Disabled Universal Group Changed

665 - Security Disabled Universal Group Member Added

666 - Security Disabled Universal Group Member Removed

667 - Security Disabled Universal Group Deleted

668 - Group Type Changed

669 - Add SID History

10/16/2015 1:31:28 AM

In: Coeur Argent Pandora Outlet...

By keglucksmdelp

670 - Add SID History

10/16/2015 1:34:18 AM

In: Replica montres TAG Heuer

By keglucksmdelp

671 - User Account Unlocked

672 - Authentication Ticket Granted

3/29/2016 2:42:39 PM

In: RE: Authentication Ticket...

By derekthomas

673 - Service Ticket Granted

4/7/2015 10:22:11 PM

In: RE: Service Name field filled...

By derekthomas

674 - Ticket Granted Renewed

675 - Pre-authentication failed

6/7/2013 6:43:36 AM

In: RE: Tracking Authentication...

By whsmith

676 - Authentication Ticket Request Failed

677 - Service Ticket Request Failed

678 - Account Mapped for Logon by

679 - The name: %2 could not be mapped for logon by: %1

12/22/2009 5:36:27 AM

In: RE: Windows Even 679

By RandyFranklinSmith

680 - Account Used for Logon by

3/29/2015 7:13:46 PM

In: RE: Windows 680 error

By derekthomas

681 - The logon to account: %2 by: %1 from workstation: %3 failed.

682 - Session reconnected to winstation

3/5/2012 12:20:00 PM

In: RE: Event 682 - UserName:...

By whsmith

683 - Session disconnected from winstation

684 - Set ACLs of members in administrators groups

685 - Account Name Changed

686 - Password of the following user accessed

687 - Basic Application Group Created

688 - Basic Application Group Changed

689 - Basic Application Group Member Added

690 - Basic Application Group Member Removed

691 - Basic Application Group Non-Member Added

692 - Basic Application Group Non-Member Removed

693 - Basic Application Group Deleted

694 - LDAP Query Group Created

695 - LDAP Query Group Changed

696 - LDAP Query Group Deleted

697 - Password Policy Checking API is called

806 - Per User Audit Policy was refreshed

807 - Per user auditing policy set for user

808 - A security event source has attempted to register

809 - A security event source has attempted to unregister

848 - The following policy was active when the Windows Firewall started

849 - An application was listed as an exception when the Windows Firewall started

850 - A port was listed as an exception when the Windows Firewall started

851 - A change has been made to the Windows Firewall application exception list

852 - A change has been made to the Windows Firewall port exception list

853 - The Windows Firewall operational mode has changed

854 - The Windows Firewall logging settings have changed

855 - A Windows Firewall ICMP setting has changed

856 - The Windows Firewall setting to allow unicast responses to multicast/broadcast traffic has changed

857 - The Windows Firewall setting to allow remote administration, allowing port TCP 135 and DCOM/RPC, has changed

858 - Windows Firewall group policy settings have been applied

859 - The Windows Firewall group policy settings have been removed

860 - The Windows Firewall has switched the active policy profile

861 - The Windows Firewall has detected an application listening for incoming traffic

1100 - The event logging service has shut down

2/13/2018 7:24:20 PM

In: RE: Event log "MARK" messages

By derekthomas

1101 - Audit events have been dropped by the transport.

1102 - The audit log was cleared

9/7/2011 4:59:50 PM

In: Know when other logs are...

By Braino

1104 - The security Log is now full

1105 - Event log automatic backup

1108 - The event logging service encountered an error

3/24/2015 6:59:00 AM

In: RE: Possible cause of event...

By Muhammed

4500 - Metabase Add Key

4501 - Metabase Delete Key

4502 - Metabase Delete Chid Keys

4503 - Metabase Copy Key

4504 - Metabase Rename Key

4505 - Metabase Set Data

4506 - Metabase Delete Data

4507 - Metabase Delete All Data

4508 - Metabase Copy Data

4509 - Metabase Set Last Change Time

4510 - Metabase Restore

4511 - Metabase Delete Backup

4512 - Metabase Import

4608 - Windows is starting up

4609 - Windows is shutting down

4/19/2014 5:29:39 PM

In: Audit / Event 4609 / generate...

By Sebastian.Grugel

4610 - An authentication package has been loaded by the Local Security Authority

4611 - A trusted logon process has been registered with the Local Security Authority

6/7/2013 6:54:37 AM

In: RE: Event ID 4611

By whsmith

4612 - Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits.

7/2/2009 12:05:23 PM

In: RE: XML form of the events.

By RandyFranklinSmith

4614 - A notification package has been loaded by the Security Account Manager.

10/11/2015 6:17:25 AM

In: Nike Outlet магазин, Nike...

By dtrinidadanto

4615 - Invalid use of LPC port

4616 - The system time was changed.

10/26/2015 5:02:08 PM

In: RE: Time changed on Domain...

By ryanaud

4618 - A monitored security event pattern has occurred

4621 - Administrator recovered system from CrashOnAuditFail

4622 - A security package has been loaded by the Local Security Authority.

6/20/2013 5:04:37 PM

In: RE: Event ID 4622

By whsmith

4624 - An account was successfully logged on

2/12/2019 2:32:13 PM

In: logon type 9 with Network...

By dickieku

4625 - An account failed to log on

3/14/2019 1:06:48 AM

In: Event 4625

By rima

4626 - User/Device claims information

4634 - An account was logged off

9/24/2017 1:39:58 PM

In: RE: Event 4634 showing...

By derekthomas

4646 - IKE DoS-prevention mode started

4647 - User initiated logoff

8/23/2016 4:58:28 PM

In: RE: How to puch events 4647,...

By nolsen311

4648 - A logon was attempted using explicit credentials

4/11/2017 1:48:48 PM

In: RE: Suspicious Process...

By derekthomas

4649 - A replay attack was detected

9/29/2018 7:35:02 PM

In: RE: A replay attack was...

By derekthomas

4650 - An IPsec Main Mode security association was established

4651 - An IPsec Main Mode security association was established

4652 - An IPsec Main Mode negotiation failed

4653 - An IPsec Main Mode negotiation failed

12/17/2010 5:13:08 AM

In: An IPsec Main Mode negotiation...

By tirupotluri

4654 - An IPsec Quick Mode negotiation failed

4655 - An IPsec Main Mode security association ended

1/17/2018 10:18:50 AM

In: How to Generate this event

By ameerm

4656 - A handle to an object was requested

4/11/2017 1:44:09 PM

In: RE: Missing Process Name for...

By derekthomas

4657 - A registry value was modified

9/8/2014 6:44:16 PM

In: RE: Regarding the event for "A...

By derekthomas

4658 - The handle to an object was closed

4659 - A handle to an object was requested with intent to delete

1/24/2019 11:55:53 AM

In: I get this event instead of...

By grantemsley

4660 - An object was deleted

8/16/2016 8:36:12 PM

In: RE: Event Id 4660 not logged...

By derekthomas

4661 - A handle to an object was requested

4662 - An operation was performed on an object

9/19/2012 11:36:43 PM

In: RE: 4662 events for DNS issues...

By whsmith

4663 - An attempt was made to access an object

8/10/2016 3:23:49 PM

In: RE: 4663 events showing up for...

By drew tittle

4664 - An attempt was made to create a hard link

10/16/2015 1:38:37 AM

In: The Shopping Cart : Zen Cart!,...

By keglucksmdelp

4665 - An attempt was made to create an application client context.

10/11/2015 6:20:17 AM

In: Оптовая Pandora алфавиты и...

By dtrinidadanto

4666 - An application attempted an operation

6/27/2009 7:48:37 AM

In: RE: i got the raw event for...

By RandyFranklinSmith

4667 - An application client context was deleted

6/27/2009 7:32:28 AM

In: RE: i got the raw event for...

By RandyFranklinSmith

4668 - An application was initialized

4670 - Permissions on an object were changed

11/14/2011 8:54:05 AM

In: RE: Uncontrolled permission...

By RandyFranklinSmith

4671 - An application attempted to access a blocked ordinal through the TBS

4672 - Special privileges assigned to new logon

1/5/2019 11:00:34 AM

In: RE: Event ID 4672 Special...

By derekthomas

4673 - A privileged service was called

4674 - An operation was attempted on a privileged object

9/14/2017 4:13:56 PM

In: RE: Question on 4674 events

By wdewey

4675 - SIDs were filtered

2/16/2012 11:16:36 AM

In: RE: Do you have a sample...

By ironhuff

4685 - The state of a transaction has changed

4688 - A new process has been created

5/30/2017 5:40:20 AM

In: new log format for Win10 /...

By jonasm

4689 - A process has exited

4690 - An attempt was made to duplicate a handle to an object

4691 - Indirect access to an object was requested

9/1/2016 2:32:54 PM

In: RE: Trojan generates 4691 in...

By derekthomas

4692 - Backup of data protection master key was attempted

4693 - Recovery of data protection master key was attempted

4694 - Protection of auditable protected data was attempted

4695 - Unprotection of auditable protected data was attempted

4696 - A primary token was assigned to process

9/10/2012 12:18:51 PM

In: RE: Event ID 5157 and 5152 in...

By whsmith

4697 - A service was installed in the system

1/28/2015 6:31:03 PM

In: RE: Regd: A Service was...

By derekthomas

4698 - A scheduled task was created

8/14/2017 4:56:49 PM

In: RE: Schedule Task Added - 4698...

By derekthomas

4699 - A scheduled task was deleted

4700 - A scheduled task was enabled

4701 - A scheduled task was disabled

4702 - A scheduled task was updated

4704 - A user right was assigned

4705 - A user right was removed

4706 - A new trust was created to a domain

8/7/2015 2:40:02 PM

In: Replica di lusso, orologi di...

By emobilemobile

4707 - A trust to a domain was removed

4709 - IPsec Services was started

4710 - IPsec Services was disabled

4711 - PAStore Engine (1%)

4712 - IPsec Services encountered a potentially serious failure

4713 - Kerberos policy was changed

3/1/2015 8:32:27 PM

In: RE: Regd: Kerberos Policy was...

By derekthomas

4714 - Encrypted data recovery policy was changed

4715 - The audit policy (SACL) on an object was changed

4716 - Trusted domain information was modified

1/14/2013 1:50:56 PM

In: RE: 4716 Trusted Domain info...

By whsmith

4717 - System security access was granted to an account

4/7/2016 7:52:31 AM

In: RE: Who actually made the...

By derekthomas

4718 - System security access was removed from an account

4719 - System audit policy was changed

4/11/2017 1:46:36 PM

In: RE: Domain Controllers logging...

By derekthomas

4720 - A user account was created

9/10/2018 8:14:34 PM

In: RE: Event ID 4720

By derekthomas

4722 - A user account was enabled

6/8/2015 8:22:01 PM

In: RE: 4722 - A user account was...

By derekthomas

4723 - An attempt was made to change an account's password

12/7/2017 4:05:33 PM

In: RE: Subject and Target...

By derekthomas

4724 - An attempt was made to reset an accounts password

2/12/2016 12:31:13 PM

In: RE: Field Account Name -...

By derekthomas

4725 - A user account was disabled

1/5/2019 10:40:49 AM

In: RE: Local Account is getting...

By derekthomas

4726 - A user account was deleted

11/25/2018 1:52:18 PM

In: RE: User account...

By derekthomas

4727 - A security-enabled global group was created

4728 - A member was added to a security-enabled global group

4729 - A member was removed from a security-enabled global group

8/20/2015 1:50:59 PM

In: RE: Member '-' was removed...

By Rolroak

4730 - A security-enabled global group was deleted

4731 - A security-enabled local group was created

4732 - A member was added to a security-enabled local group

9/13/2018 3:28:04 PM

In: Old Dominion vs Charlotte...

By usnettv

4733 - A member was removed from a security-enabled local group

4734 - A security-enabled local group was deleted

4735 - A security-enabled local group was changed

12/24/2012 4:57:10 PM

In: RE: 4735, 4732 and 4733 in a...

By whsmith

4737 - A security-enabled global group was changed

4738 - A user account was changed

4/3/2018 6:07:55 PM

In: RE: user account was changed"...

By derekthomas

4739 - Domain Policy was changed

11/18/2013 9:51:33 PM

In: RE: Event id 4739 not showing...

By derekthomas

4740 - A user account was locked out

8/27/2018 5:26:13 PM

In: RE: account lockout unable to...

By derekthomas

4741 - A computer account was created

5/3/2017 1:11:53 PM

In: RE: Information about OU

By derekthomas

4742 - A computer account was changed

1/20/2014 3:46:26 PM

In: RE: How to find that what was...

By RandyFranklinSmith

4743 - A computer account was deleted

11/8/2016 4:33:54 PM

In: RE: Do you find value in...

By derekthomas

4744 - A security-disabled local group was created

4745 - A security-disabled local group was changed

4746 - A member was added to a security-disabled local group

4747 - A member was removed from a security-disabled local group

4748 - A security-disabled local group was deleted

4749 - A security-disabled global group was created

4750 - A security-disabled global group was changed

4751 - A member was added to a security-disabled global group

4752 - A member was removed from a security-disabled global group

4753 - A security-disabled global group was deleted

4754 - A security-enabled universal group was created

4755 - A security-enabled universal group was changed

3/1/2015 8:42:22 PM

In: RE: Regd: A Security-enabled...

By derekthomas

4756 - A member was added to a security-enabled universal group

6/3/2013 11:42:13 AM

In: RE: Group Name vs. Account...

By whsmith

4757 - A member was removed from a security-enabled universal group

4758 - A security-enabled universal group was deleted

4759 - A security-disabled universal group was created

4760 - A security-disabled universal group was changed

4761 - A member was added to a security-disabled universal group

1/31/2012 1:52:28 PM

In: Incorrect information

By loftinp

4762 - A member was removed from a security-disabled universal group

4763 - A security-disabled universal group was deleted

4764 - A groups type was changed

3/1/2015 8:01:30 PM

In: RE: Regd: A group's type was...

By derekthomas

4765 - SID History was added to an account

8/30/2015 3:03:01 AM

In: Best Quality Replica Omega...

By irconiamad

4766 - An attempt to add SID History to an account failed

8/30/2015 3:08:45 AM

In: Speciale Gelegenheid Jurken -...

By irconiamad

4767 - A user account was unlocked

9/29/2018 7:29:30 PM

In: RE: Excessive 4767 Events

By derekthomas

4768 - A Kerberos authentication ticket (TGT) was requested

8/21/2018 6:22:44 PM

In: RE: Ticket Options RFC 4120...

By BryanT

4769 - A Kerberos service ticket was requested

3/28/2016 9:21:16 AM

In: RE: 4769 Domain controllers...

By derekthomas

4770 - A Kerberos service ticket was renewed

4771 - Kerberos pre-authentication failed

10/2/2018 8:43:38 AM

In: RE: How to get logon failure...

By dleate

4772 - A Kerberos authentication ticket request failed

1/23/2017 6:57:54 PM

In: RE: Difference between 4771 &...

By derekthomas

4773 - A Kerberos service ticket request failed

4774 - An account was mapped for logon

1/25/2017 2:08:29 PM

In: Yes. Yes I have seen this...

By bcrowell

4775 - An account could not be mapped for logon

4776 - The domain controller attempted to validate the credentials for an account

11/25/2018 1:53:30 PM

In: RE: How many 4776 events gets...

By derekthomas

4777 - The domain controller failed to validate the credentials for an account

4778 - A session was reconnected to a Window Station

8/4/2014 7:48:17 PM

In: RE: 4624 is getting triggered...

By derekthomas

4779 - A session was disconnected from a Window Station

4780 - The ACL was set on accounts which are members of administrators groups

2/24/2011 10:34:07 AM

In: RE: 4780 messages

By jwalzer

4781 - The name of an account was changed

10/30/2013 5:56:37 AM

In: Does'nt work on...

By cheche

4782 - The password hash an account was accessed

4783 - A basic application group was created

9/4/2010 12:39:37 PM

In: RE: How to trigger event 4783

By RandyFranklinSmith

4784 - A basic application group was changed

4785 - A member was added to a basic application group

4786 - A member was removed from a basic application group

4787 - A non-member was added to a basic application group

4788 - A non-member was removed from a basic application group..

4789 - A basic application group was deleted

4790 - An LDAP query group was created

4791 - A basic application group was changed

4792 - An LDAP query group was deleted

4793 - The Password Policy Checking API was called

4794 - An attempt was made to set the Directory Services Restore Mode administrator password

4797 - An attempt was made to query the existence of a blank password for an account

4800 - The workstation was locked

4801 - The workstation was unlocked

4/24/2016 7:12:06 PM

In: RE: How do you identify this...

By derekthomas

4802 - The screen saver was invoked

4803 - The screen saver was dismissed

4816 - RPC detected an integrity violation while decrypting an incoming message

4817 - Auditing settings on object were changed

4818 - Proposed Central Access Policy does not grant the same access permissions as the current Central Access Policy

4819 - Central Access Policies on the machine have been changed

4820 - A Kerberos Ticket-granting-ticket (TGT) was denied because the device does not meet the access control restrictions

4821 - A Kerberos service ticket was denied because the user, device, or both does not meet the access control restrictions

4822 - NTLM authentication failed because the account was a member of the Protected User group

4823 - NTLM authentication failed because access control restrictions are required

4824 - Kerberos preauthentication by using DES or RC4 failed because the account was a member of the Protected User group

4864 - A namespace collision was detected

4865 - A trusted forest information entry was added

8/30/2015 3:12:23 AM

In: Fashion Replica Patek Philippe...

By irconiamad

4866 - A trusted forest information entry was removed

8/30/2015 3:19:56 AM

In: Maurice Lacroix Pontos...

By irconiamad

4867 - A trusted forest information entry was modified

8/30/2015 3:28:31 AM

In: Best Quality Replica Omega...

By irconiamad

4868 - The certificate manager denied a pending certificate request

8/30/2015 3:33:13 AM

In: New Balance 580 Shoes Online...

By irconiamad

4869 - Certificate Services received a resubmitted certificate request

8/31/2015 5:48:28 AM

In: طبق الاصل الساعات، الساعات...

By irconiamad

4870 - Certificate Services revoked a certificate

4871 - Certificate Services received a request to publish the certificate revocation list (CRL)

8/31/2015 5:53:16 AM

In: Best Quality Replica Omega...

By irconiamad

4872 - Certificate Services published the certificate revocation list (CRL)

8/31/2015 5:57:50 AM

In: طبق الاصل ساعات أوميغا -...

By irconiamad

4873 - A certificate request extension changed

11/4/2015 8:47:11 AM

In: A certificate request...

By cohenrsc

4874 - One or more certificate request attributes changed

4875 - Certificate Services received a request to shut down

4876 - Certificate Services backup started

4877 - Certificate Services backup completed

4878 - Certificate Services restore started

4879 - Certificate Services restore completed

4880 - Certificate Services started

4881 - Certificate Services stopped

4882 - The security permissions for Certificate Services changed

4883 - Certificate Services retrieved an archived key

4884 - Certificate Services imported a certificate into its database

4885 - The audit filter for Certificate Services changed

4886 - Certificate Services received a certificate request

4887 - Certificate Services approved a certificate request and issued a certificate

4888 - Certificate Services denied a certificate request

4889 - Certificate Services set the status of a certificate request to pending

4890 - The certificate manager settings for Certificate Services changed

4891 - A configuration entry changed in Certificate Services

8/31/2015 6:00:38 AM

In: فساتين الزفاف، اير برشلونة

By irconiamad

4892 - A property of Certificate Services changed

4893 - Certificate Services archived a key

4894 - Certificate Services imported and archived a key

4895 - Certificate Services published the CA certificate to Active Directory Domain Services

7/21/2015 5:19:37 PM

In: Cheap Pandora Jewelry,Pandora...

By eerella

4896 - One or more rows have been deleted from the certificate database

4897 - Role separation enabled

4898 - Certificate Services loaded a template

4899 - A Certificate Services template was updated

5/9/2016 6:56:42 AM

In: Event not logged? Need to...

By AndrePKI

4900 - Certificate Services template security was updated

4902 - The Per-user audit policy table was created

7/21/2015 5:22:22 PM

In: montblanc crayon mécanique

By eerella

4904 - An attempt was made to register a security event source

11/1/2012 1:54:29 PM

In: RE: how can i register a...

By whsmith

4905 - An attempt was made to unregister a security event source

4906 - The CrashOnAuditFail value has changed

4907 - Auditing settings on object were changed

4908 - Special Groups Logon table modified

4909 - The local policy settings for the TBS were changed

4910 - The group policy settings for the TBS were changed

4911 - Resource attributes of the object were changed

9/8/2014 11:19:12 PM

In: RE: [event 4911][how to...

By duyetvn

4912 - Per User Audit Policy was changed

4913 - Central Access Policy on the object was changed

4928 - An Active Directory replica source naming context was established

4929 - An Active Directory replica source naming context was removed

4930 - An Active Directory replica source naming context was modified

4931 - An Active Directory replica destination naming context was modified

4932 - Synchronization of a replica of an Active Directory naming context has begun

4933 - Synchronization of a replica of an Active Directory naming context has ended

4934 - Attributes of an Active Directory object were replicated

4935 - Replication failure begins

4936 - Replication failure ends

4937 - A lingering object was removed from a replica

4944 - The following policy was active when the Windows Firewall started

4945 - A rule was listed when the Windows Firewall started

4946 - A change has been made to Windows Firewall exception list. A rule was added

8/17/2015 6:58:39 PM

In: Cheap Christian Louboutin...

By tewettcels

4947 - A change has been made to Windows Firewall exception list. A rule was modified

4948 - A change has been made to Windows Firewall exception list. A rule was deleted

4949 - Windows Firewall settings were restored to the default values

4950 - A Windows Firewall setting has changed

11/8/2012 11:11:10 PM

In: RE: Firewall Events and Other...

By erik345

4951 - A rule has been ignored because its major version number was not recognized by Windows Firewall

4952 - Parts of a rule have been ignored because its minor version number was not recognized by Windows Firewall

4953 - A rule has been ignored by Windows Firewall because it could not parse the rule

6/22/2011 9:47:48 AM

In: RE: 4953 from SNMP service

By RandyFranklinSmith

4954 - Windows Firewall Group Policy settings has changed. The new settings have been applied

3/8/2012 2:30:17 PM

In: RE: Windows Firewall Switching...

By whsmith

4956 - Windows Firewall has changed the active profile

4957 - Windows Firewall did not apply the following rule

4958 - Windows Firewall did not apply the following rule because the rule referred to items not configured on this computer

4960 - IPsec dropped an inbound packet that failed an integrity check

5/16/2016 3:05:20 PM

In: System - Audit IPsec Driver...

By franklesniak

4961 - IPsec dropped an inbound packet that failed a replay check

5/16/2016 3:05:49 PM

In: System - Audit IPsec Driver...

By franklesniak

4962 - IPsec dropped an inbound packet that failed a replay check

5/16/2016 3:06:14 PM

In: System - Audit IPsec Driver...

By franklesniak

4963 - IPsec dropped an inbound clear text packet that should have been secured

5/16/2016 3:06:40 PM

In: System - Audit IPsec Driver...

By franklesniak

4964 - Special groups have been assigned to a new logon

4965 - IPsec received a packet from a remote computer with an incorrect Security Parameter Index (SPI).

5/16/2016 3:07:33 PM

In: System - Audit IPsec Driver...

By franklesniak

4976 - During Main Mode negotiation, IPsec received an invalid negotiation packet.

4977 - During Quick Mode negotiation, IPsec received an invalid negotiation packet.

4978 - During Extended Mode negotiation, IPsec received an invalid negotiation packet.

4979 - IPsec Main Mode and Extended Mode security associations were established.

4980 - IPsec Main Mode and Extended Mode security associations were established

4981 - IPsec Main Mode and Extended Mode security associations were established

4982 - IPsec Main Mode and Extended Mode security associations were established

4983 - An IPsec Extended Mode negotiation failed

4984 - An IPsec Extended Mode negotiation failed

7/3/2012 6:06:27 PM

In: IPSec Extended Mode 4984 error...

By kurtbuff

4985 - The state of a transaction has changed

5024 - The Windows Firewall Service has started successfully

5/16/2016 3:11:12 PM

In: Error on Subcategory Page

By franklesniak

5025 - The Windows Firewall Service has been stopped

5027 - The Windows Firewall Service was unable to retrieve the security policy from the local storage

5028 - The Windows Firewall Service was unable to parse the new security policy.

8/17/2015 7:00:03 PM

In: comprar 2015 New Balance...

By tewettcels

5029 - The Windows Firewall Service failed to initialize the driver

5030 - The Windows Firewall Service failed to start

5031 - The Windows Firewall Service blocked an application from accepting incoming connections on the network.

5032 - Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network

5033 - The Windows Firewall Driver has started successfully

5034 - The Windows Firewall Driver has been stopped

5035 - The Windows Firewall Driver failed to start

5037 - The Windows Firewall Driver detected critical runtime error. Terminating

5038 - Code integrity determined that the image hash of a file is not valid

7/31/2017 2:09:42 PM

In: Sample of 5038

By sslawter

5039 - A registry key was virtualized.

5040 - A change has been made to IPsec settings. An Authentication Set was added.

5041 - A change has been made to IPsec settings. An Authentication Set was modified

5042 - A change has been made to IPsec settings. An Authentication Set was deleted

5043 - A change has been made to IPsec settings. A Connection Security Rule was added

5044 - A change has been made to IPsec settings. A Connection Security Rule was modified

3/3/2019 8:34:48 PM

In: Being a TI (targeted...

By WolfgangThomas38

5045 - A change has been made to IPsec settings. A Connection Security Rule was deleted

5046 - A change has been made to IPsec settings. A Crypto Set was added

5047 - A change has been made to IPsec settings. A Crypto Set was modified

5048 - A change has been made to IPsec settings. A Crypto Set was deleted

7/2/2009 6:37:26 AM

In: RE: Sample Log for EVID 5048

By RandyFranklinSmith

5049 - An IPsec Security Association was deleted

5050 - An attempt to programmatically disable the Windows Firewall using a call to INetFwProfile.FirewallEnabled(FALSE

5051 - A file was virtualized

5056 - A cryptographic self test was performed

5057 - A cryptographic primitive operation failed

5/16/2016 3:24:51 PM

In: Error on Subcategory Page

By franklesniak

5058 - Key file operation

9/8/2014 9:23:09 PM

In: RE: Can this be a sign of a...

By derekthomas

5059 - Key migration operation

5060 - Verification operation failed

5/16/2016 3:25:37 PM

In: System - Audit System...

By franklesniak

5061 - Cryptographic operation

7/22/2013 10:30:01 AM

In: RE: 5061: Cryptographic...

By whsmith

5062 - A kernel-mode cryptographic self test was performed

-1

5063 - A cryptographic provider operation was attempted

5064 - A cryptographic context operation was attempted

5065 - A cryptographic context modification was attempted

5066 - A cryptographic function operation was attempted

5067 - A cryptographic function modification was attempted

5068 - A cryptographic function provider operation was attempted

5069 - A cryptographic function property operation was attempted

5070 - A cryptographic function property operation was attempted

5071 - Key access denied by Microsoft key distribution service.

5120 - OCSP Responder Service Started

5121 - OCSP Responder Service Stopped

5122 - A Configuration entry changed in the OCSP Responder Service

8/17/2015 7:01:25 PM

In: Timberland Zapatos Outlet...

By tewettcels

5123 - A configuration entry changed in the OCSP Responder Service

8/17/2015 7:02:50 PM

In: Más baratos chaquetas Spyder...

By tewettcels

5124 - A security setting was updated on OCSP Responder Service

5125 - A request was submitted to OCSP Responder Service

5/25/2017 8:46:38 AM

In: Sample output from event 5125

By cohenrsc

5126 - Signing Certificate was automatically updated by the OCSP Responder Service

5127 - The OCSP Revocation Provider successfully updated the revocation information

5/25/2017 8:54:14 AM

In: Example of Event 5127

By cohenrsc

5136 - A directory service object was modified

1/7/2019 4:06:19 PM

In: RE: Max characters for the...

By g.nelson

5137 - A directory service object was created

8/17/2015 7:06:55 PM

In: baratos gafas de sol oakley...

By tewettcels

5138 - A directory service object was undeleted

5139 - A directory service object was moved

6/8/2017 5:49:09 PM

In: RE: What Audit ACE...

By derekthomas

5140 - A network share object was accessed

2/12/2016 12:52:14 PM

In: RE: Missing fields like...

By derekthomas

5141 - A directory service object was deleted

5142 - A network share object was added

382

10/11/2015 6:26:27 AM

In: Реплика Лучшие часы бренда,...

By dtrinidadanto

5143 - A network share object was modified

3/26/2017 3:42:51 PM

In: RE: 5143: A network share...

By derekthomas

5144 - A network share object was deleted

8/23/2015 7:48:33 PM

In: RE: Not Appearing

By derekthomas

5145 - A network share object was checked to see whether client can be granted desired access

9/8/2014 9:21:11 PM

In: RE: Audit File And Folders -...

By derekthomas

5146 - The Windows Filtering Platform has blocked a packet.

5147 - A more restrictive Windows Filtering Platform filter has blocked a packet.

5148 - The Windows Filtering Platform has detected a DoS attack and entered a defensive mode; packets associated with this attack will be discarded

5149 - The DoS attack has subsided and normal processing is being resumed

5150 - The Windows Filtering Platform has blocked a packet

7/17/2014 3:25:55 AM

In: 5150: The Windows Filtering...

By shubhangi

5151 - A more restrictive Windows Filtering Platform filter has blocked a packet

7/17/2014 3:19:40 AM