Security Log Expand / Collapse
<
ForumsTopicsRepliesLast Post
Normal Forum (New Posts)
512 - Windows NT is starting up
0 0
Normal Forum (New Posts)
513 - Windows is shutting down
0 0
Normal Forum (New Posts)
514 - An authentication package has been loaded by the Local Security Authority
1 1
12/7/2009 11:12:44 PM
In: RE: 14 - An authentication...
By RandyFranklinSmith
Normal Forum (New Posts)
515 - A trusted logon process has registered with the Local Security Authority
0 0
Normal Forum (New Posts)
516 - Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits
0 0
Normal Forum (New Posts)
517 - The audit log was cleared
0 0
Normal Forum (New Posts)
518 - A notification package has been loaded by the Security Account Manager
0 0
Normal Forum (New Posts)
519 - A process is using an invalid local procedure call (LPC) port
0 0
Normal Forum (New Posts)
520 - The system time was changed
0 0
Normal Forum (New Posts)
528 - Successful Logon
2 8
9/2/2009 10:27:17 AM
In: RE: What logon type for VPN...
By jwalzer
Normal Forum (New Posts)
529 - Logon Failure - Unknown user name or bad password
4 13
11/16/2009 11:25:38 AM
In: RE: source network address
By RandyFranklinSmith
Normal Forum (New Posts)
530 - Logon Failure - Account logon time restriction violation
0 0
Normal Forum (New Posts)
531 - Logon Failure - Account currently disabled
1 1
4/21/2009 5:13:34 PM
In: RE: Windows Screen Saver...
By RandyFranklinSmith
Normal Forum (New Posts)
532 - Logon Failure - The specified user account has expired
0 0
Normal Forum (New Posts)
533 - Logon Failure - User not allowed to logon at this computer
0 0
Normal Forum (New Posts)
534 - Logon Failure - The user has not been granted the requested logon type at this machine
0 0
Normal Forum (New Posts)
535 - Logon Failure - The specified account's password has expired
0 0
Normal Forum (New Posts)
536 - Logon Failure - The NetLogon component is not active
0 0
Normal Forum (New Posts)
537 - Logon failure - The logon attempt failed for other reasons.
1 2
12/22/2009 5:37:45 AM
In: RE: Event : 537
By RandyFranklinSmith
Normal Forum (New Posts)
538 - User Logoff
2 7
11/7/2009 7:59:20 AM
In: RE: Logon type 7
By RandyFranklinSmith
Normal Forum (New Posts)
539 - Logon Failure - Account locked out
0 0
Normal Forum (New Posts)
540 - Successful Network Logon
6 11
Yesterday @ 5:30:17 PM
In: RE: Many 540/538 events during...
By RandyFranklinSmith
Normal Forum (New Posts)
552 - Logon attempt using explicit credentials
1 1
9/1/2009 6:16:36 AM
In: RE: Why Enterprise Admin...
By RandyFranklinSmith
Normal Forum (New Posts)
560 - Object Open
2 6
Yesterday @ 5:31:14 PM
In: RE: How to manage Handle ID...
By RandyFranklinSmith
Normal Forum (New Posts)
561 - Handle Allocated
0 0
Normal Forum (New Posts)
562 - Handle Closed
0 0
Normal Forum (New Posts)
563 - Object Open for Delete
0 0
Normal Forum (New Posts)
564 - Object Deleted
0 0
Normal Forum (New Posts)
565 - Object Open (Active Directory)
3 13
2/16/2010 6:52:58 AM
In: RE: Security Audit displays...
By LynneBarton
Normal Forum (New Posts)
566 - Object Operation (W3 Active Directory)
1 1
8/5/2009 3:29:09 PM
In: RE: Events 836 and 837
By RandyFranklinSmith
Normal Forum (New Posts)
567 - Object Access Attempt
0 0
Normal Forum (New Posts)
576 - Special privileges assigned to new logon
0 0
Normal Forum (New Posts)
577 - Privileged Service Called
0 0
Normal Forum (New Posts)
578 - Privileged object operation
0 0
Normal Forum (New Posts)
592 - A new process has been created
0 0
Normal Forum (New Posts)
593 - A process has exited
0 0
Normal Forum (New Posts)
594 - A handle to an object has been duplicated
0 0
Normal Forum (New Posts)
595 - Indirect access to an object has been obtained
0 0
Normal Forum (New Posts)
600 - A process was assigned a primary token
0 0
Normal Forum (New Posts)
601 - Attempt to install service
0 0
Normal Forum (New Posts)
602 - Scheduled Task created
0 0
Normal Forum (New Posts)
608 - User Right Assigned
0 0
Normal Forum (New Posts)
609 - User Right Removed
0 0
Normal Forum (New Posts)
610 - New Trusted Domain
0 0
Normal Forum (New Posts)
611 - Removing Trusted Domain
0 0
Normal Forum (New Posts)
612 - Audit Policy Change
0 0
Normal Forum (New Posts)
613 - IPSec policy agent started
0 0
Normal Forum (New Posts)
614 - IPSec policy agent disabled
0 0
Normal Forum (New Posts)
615 - IPSEC PolicyAgent Service
0 0
Normal Forum (New Posts)
616 - IPSec policy agent encountered a potentially serious failure.
0 0
Normal Forum (New Posts)
617 - Kerberos Policy Changed
0 0
Normal Forum (New Posts)
618 - Encrypted Data Recovery Policy Changed
0 0
Normal Forum (New Posts)
619 - Quality of Service Policy Changed
0 0
Normal Forum (New Posts)
620 - Trusted Domain Information Modified
0 0
Normal Forum (New Posts)
621 - System Security Access Granted
0 0
Normal Forum (New Posts)
622 - System Security Access Removed
0 0
Normal Forum (New Posts)
623 - Per User Audit Policy was refreshed
0 0
Normal Forum (New Posts)
624 - User Account Created
1 4
11/18/2009 3:33:34 AM
In: RE: Privileges field in...
By jsilver
Normal Forum (New Posts)
625 - User Account Type Changed
0 0
Normal Forum (New Posts)
626 - User Account Enabled
0 0
Normal Forum (New Posts)
627 - Change Password Attempt
1 1
Yesterday @ 5:25:28 PM
In: RE: Caller of 'NT...
By RandyFranklinSmith
Normal Forum (New Posts)
628 - User Account password set
1 1
5/19/2009 7:36:13 AM
In: RE: Event ID 628 Password...
By RandyFranklinSmith
Normal Forum (New Posts)
629 - User Account Disabled
0 0
Normal Forum (New Posts)
630 - User Account Deleted
1 1
Yesterday @ 5:27:03 PM
In: RE: Deleting account by...
By RandyFranklinSmith
Normal Forum (New Posts)
631 - Security Enabled Global Group Created
0 0
Normal Forum (New Posts)
632 - Security Enabled Global Group Member Added
1 1
11/4/2009 10:24:46 AM
In: RE: Modifying SID history...
By RandyFranklinSmith
Normal Forum (New Posts)
633 - Security Enabled Global Group Member Removed
0 0
Normal Forum (New Posts)
634 - Security Enabled Global Group Deleted
0 0
Normal Forum (New Posts)
635 - Security Enabled Local Group Created
0 0
Normal Forum (New Posts)
636 - Security Enabled Local Group Member Added
0 0
Normal Forum (New Posts)
637 - Security Enabled Local Group Member Removed
0 0
Normal Forum (New Posts)
638 - Security Enabled Local Group Deleted
0 0
Normal Forum (New Posts)
639 - Security Enabled Local Group Changed
0 0
Normal Forum (New Posts)
640 - General Account Database Change
0 0
Normal Forum (New Posts)
641 - Security Enabled Global Group Changed
0 0
Normal Forum (New Posts)
642 - User Account Changed
3 5
11/2/2009 8:40:49 AM
In: RE: ASPNET account changes...
By RandyFranklinSmith
Normal Forum (New Posts)
643 - Domain Policy Changed
0 0
Normal Forum (New Posts)
644 - User Account Locked Out
1 2
6/22/2009 8:27:35 AM
In: RE: Lots of 644 for user...
By DarqAngels
Normal Forum (New Posts)
645 - Computer Account Created
0 0
Normal Forum (New Posts)
646 - Computer Account Changed
1 1
1/14/2010 10:23:25 AM
In: RE: Account changed on a...
By RandyFranklinSmith
Normal Forum (New Posts)
647 - Computer Account Deleted
0 0
Normal Forum (New Posts)
648 - Security Disabled Local Group Created
1 1
9/21/2009 8:12:13 AM
In: What is caller user name in...
By RandyFranklinSmith
Normal Forum (New Posts)
649 - Security Disabled Local Group Changed
0 0
Normal Forum (New Posts)
650 - Security Disabled Local Group Member Added
0 0
Normal Forum (New Posts)
651 - Security Disabled Local Group Member Removed
0 0
Normal Forum (New Posts)
652 - Security Disabled Local Group Deleted
0 0
Normal Forum (New Posts)
653 - Security Disabled Global Group Created
0 0
Normal Forum (New Posts)
654 - Security Disabled Global Group Changed
0 0
Normal Forum (New Posts)
655 - Security Disabled Global Group Member Added
0 0
Normal Forum (New Posts)
656 - Security Disabled Global Group Member Removed
0 0
Normal Forum (New Posts)
657 - Security Disabled Global Group Deleted
0 0
Normal Forum (New Posts)
658 - Security Enabled Universal Group Created
0 0
Normal Forum (New Posts)
659 - Security Enabled Universal Group Changed
0 0
Normal Forum (New Posts)
660 - Security Enabled Universal Group Member Added
0 0
Normal Forum (New Posts)
661 - Security Enabled Universal Group Member Removed
0 0
Normal Forum (New Posts)
662 - Security Enabled Universal Group Deleted
0 0
Normal Forum (New Posts)
663 - Security Disabled Universal Group Created
0 0
Normal Forum (New Posts)
664 - Security Disabled Universal Group Changed
0 0
Normal Forum (New Posts)
665 - Security Disabled Universal Group Member Added
0 0
Normal Forum (New Posts)
666 - Security Disabled Universal Group Member Removed
0 0
Normal Forum (New Posts)
667 - Security Disabled Universal Group Deleted
0 0
Normal Forum (New Posts)
668 - Group Type Changed
0 0
Normal Forum (New Posts)
669 - Add SID History
0 0
Normal Forum (New Posts)
670 - Add SID History
0 0
Normal Forum (New Posts)
671 - User Account Unlocked
0 0
Normal Forum (New Posts)
672 - Authentication Ticket Granted
1 1
10/29/2009 7:47:30 AM
In: RE: 672s in the middle of the...
By RandyFranklinSmith
Normal Forum (New Posts)
673 - Service Ticket Granted
0 0
Normal Forum (New Posts)
674 - Ticket Granted Renewed
0 0
Normal Forum (New Posts)
675 - Pre-authentication failed
1 2
6/27/2009 7:43:52 AM
In: RE: Pre-authentication errors...
By RandyFranklinSmith
Normal Forum (New Posts)
676 - Authentication Ticket Request Failed
0 0
Normal Forum (New Posts)
677 - Service Ticket Request Failed
0 0
Normal Forum (New Posts)
678 - Account Mapped for Logon by
0 0
Normal Forum (New Posts)
679 - The name: %2 could not be mapped for logon by: %1
1 1
12/22/2009 5:36:27 AM
In: RE: Windows Even 679
By RandyFranklinSmith
Normal Forum (New Posts)
680 - Account Used for Logon by
4 6
Yesterday @ 5:33:03 PM
In: RE: User Name Does Not Exist
By RandyFranklinSmith
Normal Forum (New Posts)
681 - The logon to account: %2 by: %1 from workstation: %3 failed.
0 0
Normal Forum (New Posts)
682 - Session reconnected to winstation
0 0
Normal Forum (New Posts)
683 - Session disconnected from winstation
0 0
Normal Forum (New Posts)
684 - Set ACLs of members in administrators groups
0 0
Normal Forum (New Posts)
685 - Account Name Changed
0 0
Normal Forum (New Posts)
686 - Password of the following user accessed
0 0
Normal Forum (New Posts)
687 - Basic Application Group Created
0 0
Normal Forum (New Posts)
688 - Basic Application Group Changed
0 0
Normal Forum (New Posts)
689 - Basic Application Group Member Added
0 0
Normal Forum (New Posts)
690 - Basic Application Group Member Removed
0 0
Normal Forum (New Posts)
691 - Basic Application Group Non-Member Added
0 0
Normal Forum (New Posts)
692 - Basic Application Group Non-Member Removed
0 0
Normal Forum (New Posts)
693 - Basic Application Group Deleted
0 0
Normal Forum (New Posts)
694 - LDAP Query Group Created
0 0
Normal Forum (New Posts)
695 - LDAP Query Group Changed
0 0
Normal Forum (New Posts)
696 - LDAP Query Group Deleted
0 0
Normal Forum (New Posts)
697 - Password Policy Checking API is called
0 0
Normal Forum (New Posts)
806 - Per User Audit Policy was refreshed
0 0
Normal Forum (New Posts)
807 - Per user auditing policy set for user
0 0
Normal Forum (New Posts)
1100 - The event logging service has shut down
0 0
Normal Forum (New Posts)
1101 - Audit events have been dropped by the transport.
0 0
Normal Forum (New Posts)
1102 - The audit log was cleared
0 0
Normal Forum (New Posts)
1104 - The security Log is now full
0 0
Normal Forum (New Posts)
1105 - Event log automatic backup
0 0
Normal Forum (New Posts)
1108 - The event logging service encountered an error
0 0
Normal Forum (New Posts)
4608 - Windows is starting up
0 0
Normal Forum (New Posts)
4609 - Windows is shutting down
0 0
Normal Forum (New Posts)
4610 - An authentication package has been loaded by the Local Security Authority
0 0
Normal Forum (New Posts)
4611 - A trusted logon process has been registered with the Local Security Authority
0 0
Normal Forum (New Posts)
4612 - Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits.
1 2
7/2/2009 12:05:23 PM
In: RE: XML form of the events.
By RandyFranklinSmith
Normal Forum (New Posts)
4614 - A notification package has been loaded by the Security Account Manager.
0 0
Normal Forum (New Posts)
4615 - Invalid use of LPC port
0 0
Normal Forum (New Posts)
4616 - The system time was changed.
0 0
Normal Forum (New Posts)
4618 - A monitored security event pattern has occurred
0 0
Normal Forum (New Posts)
4621 - Administrator recovered system from CrashOnAuditFail
0 0
Normal Forum (New Posts)
4622 - A security package has been loaded by the Local Security Authority.
0 0
Normal Forum (New Posts)
4624 - An account was successfully logged on
2 7
Today @ 7:38:22 AM
In: RE: Tracking interactive...
By RandyFranklinSmith
Normal Forum (New Posts)
4625 - An account failed to log on
3 10
2/17/2010 9:02:43 AM
In: RE: Failure information for...
By RandyFranklinSmith
Normal Forum (New Posts)
4634 - An account was logged off
0 0
Normal Forum (New Posts)
4646 - 1.00%
0 0
Normal Forum (New Posts)
4647 - User initiated logoff
0 0
Normal Forum (New Posts)
4648 - A logon was attempted using explicit credentials
1 2
2/17/2010 9:08:42 AM
In: RE: Failure events for 4648
By RandyFranklinSmith
Normal Forum (New Posts)
4649 - A replay attack was detected
0 0
Normal Forum (New Posts)
4650 - An IPsec Main Mode security association was established
0 0
Normal Forum (New Posts)
4651 - An IPsec Main Mode security association was established
0 0
Normal Forum (New Posts)
4652 - An IPsec Main Mode negotiation failed
0 0
Normal Forum (New Posts)
4653 - An IPsec Main Mode negotiation failed
0 0
Normal Forum (New Posts)
4654 - An IPsec Quick Mode negotiation failed
0 0
Normal Forum (New Posts)
4655 - An IPsec Main Mode security association ended
0 0
Normal Forum (New Posts)
4656 - A handle to an object was requested
0 1
8/26/2009 9:35:36 PM
In: What is the access for a file...
By Bill
Normal Forum (New Posts)
4657 - A registry value was modified
0 0
Normal Forum (New Posts)
4658 - The handle to an object was closed
0 0
Normal Forum (New Posts)
4659 - A handle to an object was requested with intent to delete
0 0
Normal Forum (New Posts)
4660 - An object was deleted
1 2
7/28/2009 10:17:42 AM
In: RE: Uniquely Identifying the...
By RandyFranklinSmith
Normal Forum (New Posts)
4661 - A handle to an object was requested
0 0
Normal Forum (New Posts)
4662 - An operation was performed on an object
1 9
Yesterday @ 5:34:54 PM
In: RE: Security log filling up...
By RandyFranklinSmith
Normal Forum (New Posts)
4663 - An attempt was made to access an object
1 3
2/24/2010 9:49:13 AM
In: RE: Unknown Account name
By RandyFranklinSmith
Normal Forum (New Posts)
4664 - An attempt was made to create a hard link
0 0
Normal Forum (New Posts)
4665 - An attempt was made to create an application client context.
0 0
Normal Forum (New Posts)
4666 - An application attempted an operation
1 1
6/27/2009 7:48:37 AM
In: RE: i got the raw event for...
By RandyFranklinSmith
Normal Forum (New Posts)
4667 - An application client context was deleted
1 1
6/27/2009 7:32:28 AM
In: RE: i got the raw event for...
By RandyFranklinSmith
Normal Forum (New Posts)
4668 - An application was initialized
0 0
Normal Forum (New Posts)
4670 - Permissions on an object were changed
0 0
Normal Forum (New Posts)
4671 - An application attempted to access a blocked ordinal through the TBS
0 0
Normal Forum (New Posts)
4672 - Special privileges assigned to new logon
0 0
Normal Forum (New Posts)
4673 - A privileged service was called
0 0
Normal Forum (New Posts)
4674 - An operation was attempted on a privileged object
1 1
11/18/2009 9:25:21 AM
In: RE: EventID 4674 is generated...
By RandyFranklinSmith
Normal Forum (New Posts)
4675 - SIDs were filtered
0 0
Normal Forum (New Posts)
4685 - The state of a transaction has changed
0 0
Normal Forum (New Posts)
4688 - A new process has been created
0 0
Normal Forum (New Posts)
4689 - A process has exited
0 0
Normal Forum (New Posts)
4690 - An attempt was made to duplicate a handle to an object
0 0
Normal Forum (New Posts)
4691 - Indirect access to an object was requested
0 0
Normal Forum (New Posts)
4692 - Backup of data protection master key was attempted
0 0
Normal Forum (New Posts)
4693 - Recovery of data protection master key was attempted
0 0
Normal Forum (New Posts)
4694 - Protection of auditable protected data was attempted
0 0
Normal Forum (New Posts)
4695 - Unprotection of auditable protected data was attempted
0 0
Normal Forum (New Posts)
4696 - A primary token was assigned to process
0 0
Normal Forum (New Posts)
4697 - A service was installed in the system
0 0
Normal Forum (New Posts)
4698 - A scheduled task was created
0 0
Normal Forum (New Posts)
4699 - A scheduled task was deleted
0 0
Normal Forum (New Posts)
4700 - A scheduled task was enabled
0 0
Normal Forum (New Posts)
4701 - A scheduled task was disabled
0 0
Normal Forum (New Posts)
4702 - A scheduled task was updated
0 0
Normal Forum (New Posts)
4704 - A user right was assigned
0 0
Normal Forum (New Posts)
4705 - A user right was removed
0 0
Normal Forum (New Posts)
4706 - A new trust was created to a domain
0 0
Normal Forum (New Posts)
4707 - A trust to a domain was removed
0 0
Normal Forum (New Posts)
4709 - IPsec Services was started
0 0
Normal Forum (New Posts)
4710 - IPsec Services was disabled
0 0
Normal Forum (New Posts)
4711 - PAStore Engine (1%)
0 0
Normal Forum (New Posts)
4712 - IPsec Services encountered a potentially serious failure
0 0
Normal Forum (New Posts)
4713 - Kerberos policy was changed
0 0
Normal Forum (New Posts)
4714 - Encrypted data recovery policy was changed
0 0
Normal Forum (New Posts)
4715 - The audit policy (SACL) on an object was changed
0 0
Normal Forum (New Posts)
4716 - Trusted domain information was modified
0 0
Normal Forum (New Posts)
4717 - System security access was granted to an account
0 0
Normal Forum (New Posts)
4718 - System security access was removed from an account
0 0
Normal Forum (New Posts)
4719 - System audit policy was changed
0 0
Normal Forum (New Posts)
4720 - A user account was created
0 0
Normal Forum (New Posts)
4722 - A user account was enabled
0 0
Normal Forum (New Posts)
4723 - An attempt was made to change an account's password
0 0
Normal Forum (New Posts)
4724 - An attempt was made to reset an accounts password
0 0
Normal Forum (New Posts)
4725 - A user account was disabled
0 0
Normal Forum (New Posts)
4726 - A user account was deleted
0 0
Normal Forum (New Posts)
4727 - A security-enabled global group was created
0 0
Normal Forum (New Posts)
4728 - A member was added to a security-enabled global group
0 0
Normal Forum (New Posts)
4729 - A member was removed from a security-enabled global group
0 0
Normal Forum (New Posts)
4730 - A security-enabled global group was deleted
0 0
Normal Forum (New Posts)
4731 - A security-enabled local group was created
0 0
Normal Forum (New Posts)
4732 - A member was added to a security-enabled local group
1 2
10/23/2009 12:43:18 PM
In: RE: Account Name shown as a...
By Braino
Normal Forum (New Posts)
4733 - A member was removed from a security-enabled local group
0 0
Normal Forum (New Posts)
4734 - A security-enabled local group was deleted
0 0
Normal Forum (New Posts)
4735 - A security-enabled local group was changed
0 0
Normal Forum (New Posts)
4737 - A security-enabled global group was changed
0 0
Normal Forum (New Posts)
4738 - A user account was changed
0 0
Normal Forum (New Posts)
4739 - Domain Policy was changed
1 1
11/17/2009 8:44:37 AM
In: RE: Subcategory that event...
By RandyFranklinSmith
Normal Forum (New Posts)
4740 - A user account was locked out
0 0
Normal Forum (New Posts)
4741 - A computer account was created
0 0
Normal Forum (New Posts)
4742 - A computer account was changed
0 0
Normal Forum (New Posts)
4743 - A computer account was deleted
0 0
Normal Forum (New Posts)
4744 - A security-disabled local group was created
0 0
Normal Forum (New Posts)
4745 - A security-disabled local group was changed
0 0
Normal Forum (New Posts)
4746 - A member was added to a security-disabled local group
0 0
Normal Forum (New Posts)
4747 - A member was removed from a security-disabled local group
0 0
Normal Forum (New Posts)
4748 - A security-disabled local group was deleted
0 0
Normal Forum (New Posts)
4749 - A security-disabled global group was created
0 0
Normal Forum (New Posts)
4750 - A security-disabled global group was changed
0 0
Normal Forum (New Posts)
4751 - A member was added to a security-disabled global group
0 0
Normal Forum (New Posts)
4752 - A member was removed from a security-disabled global group
0 0
Normal Forum (New Posts)
4753 - A security-disabled global group was deleted
0 0
Normal Forum (New Posts)
4754 - A security-enabled universal group was created
0 0
Normal Forum (New Posts)
4755 - A security-enabled universal group was changed
0 0
Normal Forum (New Posts)
4756 - A member was added to a security-enabled universal group
0 0
Normal Forum (New Posts)
4757 - A member was removed from a security-enabled universal group
0 0
Normal Forum (New Posts)
4758 - A security-enabled universal group was deleted
0 0
Normal Forum (New Posts)
4759 - A security-disabled universal group was created
0 0
Normal Forum (New Posts)
4760 - A security-disabled universal group was changed
0 0
Normal Forum (New Posts)
4761 - A member was added to a security-disabled universal group
0 0
Normal Forum (New Posts)
4762 - A member was removed from a security-disabled universal group
0 0
Normal Forum (New Posts)
4763 - A security-disabled universal group was deleted
0 0
Normal Forum (New Posts)
4764 - A groups type was changed
0 0
Normal Forum (New Posts)
4765 - SID History was added to an account
0 0
Normal Forum (New Posts)
4766 - An attempt to add SID History to an account failed
0 0
Normal Forum (New Posts)
4767 - A user account was unlocked
0 0
Normal Forum (New Posts)
4768 - A Kerberos authentication ticket (TGT) was requested
1 1
9/1/2009 6:20:56 AM
In: RE: Randy's Example - Client...
By RandyFranklinSmith
Normal Forum (New Posts)
4769 - A Kerberos service ticket was requested
0 0