Forum
Who's Online
Who's Online
User
Last Action...
Performed...
PM
Email
Google.com
(66.249.71.228)
Viewing Calendar
Today @ 10:22:31 AM
Google.com
(66.249.71.228)
Viewing Calendar
Today @ 10:22:05 AM
Google.com
(66.249.71.228)
Viewing Calendar
Today @ 10:21:39 AM
Google.com
(66.249.71.228)
Viewing Calendar
Today @ 10:21:12 AM
Anonymous
(192.223.243.6)
Reading Topic
:
Security 680 Audit Failure 9 \SYSTEM...
Today @ 10:21:06 AM
Google.com
(66.249.71.228)
Viewing Calendar
Today @ 10:20:46 AM
Google.com
(66.249.71.228)
Viewing Calendar
Today @ 10:20:36 AM
Google.com
(66.249.71.228)
Viewing Calendar
Today @ 10:20:20 AM
Anonymous
(62.14.231.58)
Reading Topic
:
Event ID 4625 and NULL SID with 0xc000006d
Today @ 10:20:12 AM
Google.com
(66.249.71.228)
Viewing Calendar
Today @ 10:19:27 AM
Google.com
(66.249.71.228)
Viewing Calendar
Today @ 10:19:04 AM
Google.com
(66.249.71.228)
Viewing Calendar
Today @ 10:19:01 AM
Google.com
(66.249.71.228)
Viewing Calendar
Today @ 10:18:35 AM
Google.com
(66.249.71.228)
Viewing Calendar
Today @ 10:17:42 AM
Anonymous
(199.164.150.19)
Reading Topic
:
Event ID 4625 and NULL SID with 0xc000006d
Today @ 10:17:35 AM
Google.com
(66.249.71.228)
Viewing Calendar
Today @ 10:17:16 AM
Anonymous
(206.214.211.23)
Viewing Homepage
Today @ 10:17:06 AM
Google.com
(66.249.71.228)
Viewing Calendar
Today @ 10:16:50 AM
Google.com
(66.249.71.228)
Viewing Calendar
Today @ 10:16:24 AM
Anonymous
(199.164.150.19)
Reading Topic
:
7000 NULL SID 4625's in 3 Days
Today @ 10:16:13 AM
72 users, Page 2 of 4
««
1
2
3
4
»
»»
Forum Jump...
----------------
Forum Home
Search
Members List
Calendar
Who's Online
----------------
Ultimate Windows Security Forum
|-- IT Audit
|---- Active Directory
|---- Windows Server
|---- SharePoint
|---- SQL Server
|-- Security Log
|---- 11 - Site collection audit policy changed
|---- 12 - Audit policy changed
|---- 13 - Document checked in
|---- 14 - Document checked out
|---- 15 - Child object deleted
|---- 16 - Child object moved
|---- 17 - Object copied
|---- 18 - Custom event
|---- 19 - Object deleted
|---- 20 - SharePoint audit logs deleted
|---- 21 - Object moved
|---- 22 - Object profile changed
|---- 23 - SharePoint object structure changed
|---- 24 - Search performed
|---- 25 - SharePoint group created
|---- 26 - SharePoint group deleted
|---- 27 - SharePoint group member added
|---- 28 - SharePoint group member removed
|---- 29 - Unique permissions created
|---- 30 - Unique permissions removed
|---- 31 - Permissions updated
|---- 32 - Permissions removed
|---- 33 - Unique permission levels created
|---- 34 - Permission level created
|---- 35 - Permission level deleted
|---- 36 - Permission level modified
|---- 37 - SharePoint site collection administrator...
|---- 38 - SharePoint site collection administrator...
|---- 39 - Object restored
|---- 40 - Site collection updated
|---- 41 - Web updated
|---- 42 - Document library updated
|---- 43 - Document updated
|---- 44 - List updated
|---- 45 - List item updated
|---- 46 - Folder updated
|---- 47 - Document viewed
|---- 48 - Document library viewed
|---- 49 - List viewed
|---- 50 - Object viewed
|---- 51 - Workflow accessed
|---- 52 - Information management policy created
|---- 53 - Information management policy changed
|---- 54 - Site collection information management...
|---- 55 - Site collection information management...
|---- 56 - Export of objects started
|---- 57 - Export of objects completed
|---- 58 - Import of objects started
|---- 59 - Import of objects completed
|---- 60 - Possible tampering warning
|---- 61 - Retention policy processed
|---- 512 - Windows NT is starting up
|---- 513 - Windows is shutting down
|---- 514 - An authentication package has been...
|---- 515 - A trusted logon process has registered...
|---- 516 - Internal resources allocated for the...
|---- 517 - The audit log was cleared
|---- 518 - A notification package has been loaded...
|---- 519 - A process is using an invalid local...
|---- 520 - The system time was changed
|---- 528 - Successful Logon
|---- 529 - Logon Failure - Unknown user name or...
|---- 530 - Logon Failure - Account logon time...
|---- 531 - Logon Failure - Account currently...
|---- 532 - Logon Failure - The specified user...
|---- 533 - Logon Failure - User not allowed to...
|---- 534 - Logon Failure - The user has not been...
|---- 535 - Logon Failure - The specified account's...
|---- 536 - Logon Failure - The NetLogon component...
|---- 537 - Logon failure - The logon attempt...
|---- 538 - User Logoff
|---- 539 - Logon Failure - Account locked out
|---- 540 - Successful Network Logon
|---- 552 - Logon attempt using explicit...
|---- 560 - Object Open
|---- 561 - Handle Allocated
|---- 562 - Handle Closed
|---- 563 - Object Open for Delete
|---- 564 - Object Deleted
|---- 565 - Object Open (Active Directory)
|---- 566 - Object Operation (W3 Active Directory)
|---- 567 - Object Access Attempt
|---- 576 - Special privileges assigned to new...
|---- 577 - Privileged Service Called
|---- 578 - Privileged object operation
|---- 592 - A new process has been created
|---- 593 - A process has exited
|---- 594 - A handle to an object has been...
|---- 595 - Indirect access to an object has been...
|---- 600 - A process was assigned a primary token
|---- 601 - Attempt to install service
|---- 602 - Scheduled Task created
|---- 608 - User Right Assigned
|---- 609 - User Right Removed
|---- 610 - New Trusted Domain
|---- 611 - Removing Trusted Domain
|---- 612 - Audit Policy Change
|---- 613 - IPSec policy agent started
|---- 614 - IPSec policy agent disabled
|---- 615 - IPSEC PolicyAgent Service
|---- 616 - IPSec policy agent encountered a...
|---- 617 - Kerberos Policy Changed
|---- 618 - Encrypted Data Recovery Policy Changed
|---- 619 - Quality of Service Policy Changed
|---- 620 - Trusted Domain Information Modified
|---- 621 - System Security Access Granted
|---- 622 - System Security Access Removed
|---- 623 - Per User Audit Policy was refreshed
|---- 624 - User Account Created
|---- 625 - User Account Type Changed
|---- 626 - User Account Enabled
|---- 627 - Change Password Attempt
|---- 628 - User Account password set
|---- 629 - User Account Disabled
|---- 630 - User Account Deleted
|---- 631 - Security Enabled Global Group Created
|---- 632 - Security Enabled Global Group Member...
|---- 633 - Security Enabled Global Group Member...
|---- 634 - Security Enabled Global Group Deleted
|---- 635 - Security Enabled Local Group Created
|---- 636 - Security Enabled Local Group Member...
|---- 637 - Security Enabled Local Group Member...
|---- 638 - Security Enabled Local Group Deleted
|---- 639 - Security Enabled Local Group Changed
|---- 640 - General Account Database Change
|---- 641 - Security Enabled Global Group Changed
|---- 642 - User Account Changed
|---- 643 - Domain Policy Changed
|---- 644 - User Account Locked Out
|---- 645 - Computer Account Created
|---- 646 - Computer Account Changed
|---- 647 - Computer Account Deleted
|---- 648 - Security Disabled Local Group Created
|---- 649 - Security Disabled Local Group Changed
|---- 650 - Security Disabled Local Group Member...
|---- 651 - Security Disabled Local Group Member...
|---- 652 - Security Disabled Local Group Deleted
|---- 653 - Security Disabled Global Group Created
|---- 654 - Security Disabled Global Group Changed
|---- 655 - Security Disabled Global Group Member...
|---- 656 - Security Disabled Global Group Member...
|---- 657 - Security Disabled Global Group Deleted
|---- 658 - Security Enabled Universal Group...
|---- 659 - Security Enabled Universal Group...
|---- 660 - Security Enabled Universal Group Member...
|---- 661 - Security Enabled Universal Group Member...
|---- 662 - Security Enabled Universal Group...
|---- 663 - Security Disabled Universal Group...
|---- 664 - Security Disabled Universal Group...
|---- 665 - Security Disabled Universal Group...
|---- 666 - Security Disabled Universal Group...
|---- 667 - Security Disabled Universal Group...
|---- 668 - Group Type Changed
|---- 669 - Add SID History
|---- 670 - Add SID History
|---- 671 - User Account Unlocked
|---- 672 - Authentication Ticket Granted
|---- 673 - Service Ticket Granted
|---- 674 - Ticket Granted Renewed
|---- 675 - Pre-authentication failed
|---- 676 - Authentication Ticket Request Failed
|---- 677 - Service Ticket Request Failed
|---- 678 - Account Mapped for Logon by
|---- 679 - The name: %2 could not be mapped for...
|---- 680 - Account Used for Logon by
|---- 681 - The logon to account: %2 by: %1 from...
|---- 682 - Session reconnected to winstation
|---- 683 - Session disconnected from winstation
|---- 684 - Set ACLs of members in administrators...
|---- 685 - Account Name Changed
|---- 686 - Password of the following user accessed...
|---- 687 - Basic Application Group Created
|---- 688 - Basic Application Group Changed
|---- 689 - Basic Application Group Member Added
|---- 690 - Basic Application Group Member Removed
|---- 691 - Basic Application Group Non-Member...
|---- 692 - Basic Application Group Non-Member...
|---- 693 - Basic Application Group Deleted
|---- 694 - LDAP Query Group Created
|---- 695 - LDAP Query Group Changed
|---- 696 - LDAP Query Group Deleted
|---- 697 - Password Policy Checking API is called...
|---- 806 - Per User Audit Policy was refreshed
|---- 807 - Per user auditing policy set for user
|---- 1100 - The event logging service has shut...
|---- 1101 - Audit events have been dropped by the...
|---- 1102 - The audit log was cleared
|---- 1104 - The security Log is now full
|---- 1105 - Event log automatic backup
|---- 1108 - The event logging service encountered...
|---- 4500 - Metabase Add Key
|---- 4501 - Metabase Delete Key
|---- 4502 - Metabase Delete Chid Keys
|---- 4503 - Metabase Copy Key
|---- 4504 - Metabase Rename Key
|---- 4505 - Metabase Set Data
|---- 4506 - Metabase Delete Data
|---- 4507 - Metabase Delete All Data
|---- 4508 - Metabase Copy Data
|---- 4509 - Metabase Set Last Change Time
|---- 4510 - Metabase Restore
|---- 4511 - Metabase Delete Backup
|---- 4512 - Metabase Import
|---- 4608 - Windows is starting up
|---- 4609 - Windows is shutting down
|---- 4610 - An authentication package has been...
|---- 4611 - A trusted logon process has been...
|---- 4612 - Internal resources allocated for the...
|---- 4614 - A notification package has been loaded...
|---- 4615 - Invalid use of LPC port
|---- 4616 - The system time was changed.
|---- 4618 - A monitored security event pattern has...
|---- 4621 - Administrator recovered system from...
|---- 4622 - A security package has been loaded by...
|---- 4624 - An account was successfully logged on
|---- 4625 - An account failed to log on
|---- 4634 - An account was logged off
|---- 4646 - 1.00%
|---- 4647 - User initiated logoff
|---- 4648 - A logon was attempted using explicit...
|---- 4649 - A replay attack was detected
|---- 4650 - An IPsec Main Mode security...
|---- 4651 - An IPsec Main Mode security...
|---- 4652 - An IPsec Main Mode negotiation failed
|---- 4653 - An IPsec Main Mode negotiation failed
|---- 4654 - An IPsec Quick Mode negotiation failed...
|---- 4655 - An IPsec Main Mode security...
|---- 4656 - A handle to an object was requested
|---- 4657 - A registry value was modified
|---- 4658 - The handle to an object was closed
|---- 4659 - A handle to an object was requested...
|---- 4660 - An object was deleted
|---- 4661 - A handle to an object was requested
|---- 4662 - An operation was performed on an...
|---- 4663 - An attempt was made to access an...
|---- 4664 - An attempt was made to create a hard...
|---- 4665 - An attempt was made to create an...
|---- 4666 - An application attempted an operation
|---- 4667 - An application client context was...
|---- 4668 - An application was initialized
|---- 4670 - Permissions on an object were changed
|---- 4671 - An application attempted to access a...
|---- 4672 - Special privileges assigned to new...
|---- 4673 - A privileged service was called
|---- 4674 - An operation was attempted on a...
|---- 4675 - SIDs were filtered
|---- 4685 - The state of a transaction has changed...
|---- 4688 - A new process has been created
|---- 4689 - A process has exited
|---- 4690 - An attempt was made to duplicate a...
|---- 4691 - Indirect access to an object was...
|---- 4692 - Backup of data protection master key...
|---- 4693 - Recovery of data protection master key...
|---- 4694 - Protection of auditable protected data...
|---- 4695 - Unprotection of auditable protected...
|---- 4696 - A primary token was assigned to...
|---- 4697 - A service was installed in the system
|---- 4698 - A scheduled task was created
|---- 4699 - A scheduled task was deleted
|---- 4700 - A scheduled task was enabled
|---- 4701 - A scheduled task was disabled
|---- 4702 - A scheduled task was updated
|---- 4704 - A user right was assigned
|---- 4705 - A user right was removed
|---- 4706 - A new trust was created to a domain
|---- 4707 - A trust to a domain was removed
|---- 4709 - IPsec Services was started
|---- 4710 - IPsec Services was disabled
|---- 4711 - PAStore Engine (1%)
|---- 4712 - IPsec Services encountered a...
|---- 4713 - Kerberos policy was changed
|---- 4714 - Encrypted data recovery policy was...
|---- 4715 - The audit policy (SACL) on an object...
|---- 4716 - Trusted domain information was...
|---- 4717 - System security access was granted to...
|---- 4718 - System security access was removed...
|---- 4719 - System audit policy was changed
|---- 4720 - A user account was created
|---- 4722 - A user account was enabled
|---- 4723 - An attempt was made to change an...
|---- 4724 - An attempt was made to reset an...
|---- 4725 - A user account was disabled
|---- 4726 - A user account was deleted
|---- 4727 - A security-enabled global group was...
|---- 4728 - A member was added to a...
|---- 4729 - A member was removed from a...
|---- 4730 - A security-enabled global group was...
|---- 4731 - A security-enabled local group was...
|---- 4732 - A member was added to a...
|---- 4733 - A member was removed from a...
|---- 4734 - A security-enabled local group was...
|---- 4735 - A security-enabled local group was...
|---- 4737 - A security-enabled global group was...
|---- 4738 - A user account was changed
|---- 4739 - Domain Policy was changed
|---- 4740 - A user account was locked out
|---- 4741 - A computer account was created
|---- 4742 - A computer account was changed
|---- 4743 - A computer account was deleted
|---- 4744 - A security-disabled local group was...
|---- 4745 - A security-disabled local group was...
|---- 4746 - A member was added to a...
|---- 4747 - A member was removed from a...
|---- 4748 - A security-disabled local group was...
|---- 4749 - A security-disabled global group was...
|---- 4750 - A security-disabled global group was...
|---- 4751 - A member was added to a...
|---- 4752 - A member was removed from a...
|---- 4753 - A security-disabled global group was...
|---- 4754 - A security-enabled universal group was...
|---- 4755 - A security-enabled universal group was...
|---- 4756 - A member was added to a...
|---- 4757 - A member was removed from a...
|---- 4758 - A security-enabled universal group was...
|---- 4759 - A security-disabled universal group...
|---- 4760 - A security-disabled universal group...
|---- 4761 - A member was added to a...
|---- 4762 - A member was removed from a...
|---- 4763 - A security-disabled universal group...
|---- 4764 - A groups type was changed
|---- 4765 - SID History was added to an account
|---- 4766 - An attempt to add SID History to an...
|---- 4767 - A user account was unlocked
|---- 4768 - A Kerberos authentication ticket (TGT)...
|---- 4769 - A Kerberos service ticket was...
|---- 4770 - A Kerberos service ticket was renewed
|---- 4771 - Kerberos pre-authentication failed
|---- 4772 - A Kerberos authentication ticket...
|---- 4773 - A Kerberos service ticket request...
|---- 4774 - An account was mapped for logon
|---- 4775 - An account could not be mapped for...
|---- 4776 - The domain controller attempted to...
|---- 4777 - The domain controller failed to...
|---- 4778 - A session was reconnected to a Window...
|---- 4779 - A session was disconnected from a...
|---- 4780 - The ACL was set on accounts which are...
|---- 4781 - The name of an account was changed
|---- 4782 - The password hash an account was...
|---- 4783 - A basic application group was created
|---- 4784 - A basic application group was changed
|---- 4785 - A member was added to a basic...
|---- 4786 - A member was removed from a basic...
|---- 4787 - A non-member was added to a basic...
|---- 4788 - A non-member was removed from a basic...
|---- 4789 - A basic application group was deleted
|---- 4790 - An LDAP query group was created
|---- 4791 - A basic application group was changed
|---- 4792 - An LDAP query group was deleted
|---- 4793 - The Password Policy Checking API was...
|---- 4794 - An attempt was made to set the...
|---- 4800 - The workstation was locked
|---- 4801 - The workstation was unlocked
|---- 4802 - The screen saver was invoked
|---- 4803 - The screen saver was dismissed
|---- 4816 - RPC detected an integrity violation...
|---- 4864 - A namespace collision was detected
|---- 4865 - A trusted forest information entry was...
|---- 4866 - A trusted forest information entry was...
|---- 4867 - A trusted forest information entry was...
|---- 4868 - The certificate manager denied a...
|---- 4869 - Certificate Services received a...
|---- 4870 - Certificate Services revoked a...
|---- 4871 - Certificate Services received a...
|---- 4872 - Certificate Services published the...
|---- 4873 - A certificate request extension...
|---- 4875 - Certificate Services received a...
|---- 4876 - Certificate Services backup started
|---- 4877 - Certificate Services backup completed
|---- 4878 - Certificate Services restore started
|---- 4879 - Certificate Services restore completed...
|---- 4880 - Certificate Services started
|---- 4881 - Certificate Services stopped
|---- 4882 - The security permissions for...
|---- 4883 - Certificate Services retrieved an...
|---- 4884 - Certificate Services imported a...
|---- 4885 - The audit filter for Certificate...
|---- 4886 - Certificate Services received a...
|---- 4887 - Certificate Services approved a...
|---- 4888 - Certificate Services denied a...
|---- 4889 - Certificate Services set the status of...
|---- 4891 - A configuration entry changed in...
|---- 4892 - A property of Certificate Services...
|---- 4893 - Certificate Services archived a key
|---- 4894 - Certificate Services imported and...
|---- 4895 - Certificate Services published the CA...
|---- 4896 - One or more rows have been deleted...
|---- 4897 - Role separation enabled
|---- 4898 - Certificate Services loaded a template...
|---- 4899 - A Certificate Services template was...
|---- 4900 - Certificate Services template security...
|---- 4902 - The Per-user audit policy table was...
|---- 4904 - An attempt was made to register a...
|---- 4905 - An attempt was made to unregister a...
|---- 4906 - The CrashOnAuditFail value has changed...
|---- 4907 - Auditing settings on object were...
|---- 4908 - Special Groups Logon table modified
|---- 4909 - The local policy settings for the TBS...
|---- 4910 - The group policy settings for the TBS...
|---- 4912 - Per User Audit Policy was changed
|---- 4928 - An Active Directory replica source...
|---- 4929 - An Active Directory replica source...
|---- 4930 - An Active Directory replica source...
|---- 4931 - An Active Directory replica...
|---- 4932 - Synchronization of a replica of an...
|---- 4933 - Synchronization of a replica of an...
|---- 4934 - Attributes of an Active Directory...
|---- 4935 - Replication failure begins
|---- 4936 - Replication failure ends
|---- 4937 - A lingering object was removed from a...
|---- 4944 - The following policy was active when...
|---- 4945 - A rule was listed when the Windows...
|---- 4946 - A change has been made to Windows...
|---- 4947 - A change has been made to Windows...
|---- 4948 - A change has been made to Windows...
|---- 4949 - Windows Firewall settings were...
|---- 4950 - A Windows Firewall setting has changed...
|---- 4951 - A rule has been ignored because its...
|---- 4952 - Parts of a rule have been ignored...
|---- 4953 - A rule has been ignored by Windows...
|---- 4954 - Windows Firewall Group Policy settings...
|---- 4956 - Windows Firewall has changed the...
|---- 4957 - Windows Firewall did not apply the...
|---- 4958 - Windows Firewall did not apply the...
|---- 4960 - IPsec dropped an inbound packet that...
|---- 4961 - IPsec dropped an inbound packet that...
|---- 4962 - IPsec dropped an inbound packet that...
|---- 4963 - IPsec dropped an inbound clear text...
|---- 4964 - Special groups have been assigned to a...
|---- 4965 - IPsec received a packet from a remote...
|---- 4976 - During Main Mode negotiation, IPsec...
|---- 4977 - During Quick Mode negotiation, IPsec...
|---- 4978 - During Extended Mode negotiation,...
|---- 4979 - IPsec Main Mode and Extended Mode...
|---- 4980 - IPsec Main Mode and Extended Mode...
|---- 4981 - IPsec Main Mode and Extended Mode...
|---- 4982 - IPsec Main Mode and Extended Mode...
|---- 4983 - An IPsec Extended Mode negotiation...
|---- 4984 - An IPsec Extended Mode negotiation...
|---- 4985 - The state of a transaction has changed...
|---- 5024 - The Windows Firewall Service has...
|---- 5025 - The Windows Firewall Service has been...
|---- 5027 - The Windows Firewall Service was...
|---- 5028 - The Windows Firewall Service was...
|---- 5029 - The Windows Firewall Service failed to...
|---- 5030 - The Windows Firewall Service failed to...
|---- 5031 - The Windows Firewall Service blocked...
|---- 5032 - Windows Firewall was unable to notify...
|---- 5033 - The Windows Firewall Driver has...
|---- 5034 - The Windows Firewall Driver has been...
|---- 5035 - The Windows Firewall Driver failed to...
|---- 5037 - The Windows Firewall Driver detected...
|---- 5038 - Code integrity determined that the...
|---- 5039 - A registry key was virtualized.
|---- 5040 - A change has been made to IPsec...
|---- 5041 - A change has been made to IPsec...
|---- 5042 - A change has been made to IPsec...
|---- 5043 - A change has been made to IPsec...
|---- 5044 - A change has been made to IPsec...
|---- 5045 - A change has been made to IPsec...
|---- 5046 - A change has been made to IPsec...
|---- 5047 - A change has been made to IPsec...
|---- 5048 - A change has been made to IPsec...
|---- 5049 - An IPsec Security Association was...
|---- 5050 - An attempt to programmatically disable...
|---- 5051 - A file was virtualized
|---- 5056 - A cryptographic self test was...
|---- 5057 - A cryptographic primitive operation...
|---- 5058 - Key file operation
|---- 5059 - Key migration operation
|---- 5060 - Verification operation failed
|---- 5061 - Cryptographic operation
|---- 5062 - A kernel-mode cryptographic self test...
|---- 5063 - A cryptographic provider operation was...
|---- 5064 - A cryptographic context operation was...
|---- 5065 - A cryptographic context modification...
|---- 5066 - A cryptographic function operation was...
|---- 5067 - A cryptographic function modification...
|---- 5068 - A cryptographic function provider...
|---- 5069 - A cryptographic function property...
|---- 5070 - A cryptographic function property...
|---- 5120 - OCSP Responder Service Started
|---- 5121 - OCSP Responder Service Stopped
|---- 5122 - A Configuration entry changed in the...
|---- 5123 - A configuration entry changed in the...
|---- 5124 - A security setting was updated on OCSP...
|---- 5125 - A request was submitted to OCSP...
|---- 5126 - Signing Certificate was automatically...
|---- 5127 - The OCSP Revocation Provider...
|---- 5136 - A directory service object was...
|---- 5137 - A directory service object was created...
|---- 5138 - A directory service object was...
|---- 5139 - A directory service object was moved
|---- 5140 - A network share object was accessed
|---- 5141 - A directory service object was deleted...
|---- 5152 - The Windows Filtering Platform blocked...
|---- 5153 - A more restrictive Windows Filtering...
|---- 5154 - The Windows Filtering Platform has...
|---- 5155 - The Windows Filtering Platform has...
|---- 5156 - The Windows Filtering Platform has...
|---- 5157 - The Windows Filtering Platform has...
|---- 5158 - The Windows Filtering Platform has...
|---- 5159 - The Windows Filtering Platform has...
|---- 5376 - Credential Manager credentials were...
|---- 5377 - Credential Manager credentials were...
|---- 5378 - The requested credentials delegation...
|---- 5440 - The following callout was present when...
|---- 5441 - The following filter was present when...
|---- 5442 - The following provider was present...
|---- 5443 - The following provider context was...
|---- 5444 - The following sub-layer was present...
|---- 5446 - A Windows Filtering Platform callout...
|---- 5447 - A Windows Filtering Platform filter...
|---- 5448 - A Windows Filtering Platform provider...
|---- 5449 - A Windows Filtering Platform provider...
|---- 5450 - A Windows Filtering Platform sub-layer...
|---- 5451 - An IPsec Quick Mode security...
|---- 5452 - An IPsec Quick Mode security...
|---- 5453 - An IPsec negotiation with a remote...
|---- 5456 - PAStore Engine applied Active...
|---- 5457 - PAStore Engine failed to apply Active...
|---- 5458 - PAStore Engine applied locally cached...
|---- 5459 - PAStore Engine failed to apply locally...
|---- 5460 - PAStore Engine applied local registry...
|---- 5461 - PAStore Engine failed to apply local...
|---- 5462 - PAStore Engine failed to apply some...
|---- 5463 - PAStore Engine polled for changes to...
|---- 5464 - PAStore Engine polled for changes to...
|---- 5465 - PAStore Engine received a control for...
|---- 5466 - PAStore Engine polled for changes to...
|---- 5467 - PAStore Engine polled for changes to...
|---- 5468 - PAStore Engine polled for changes to...
|---- 5471 - PAStore Engine loaded local storage...
|---- 5472 - PAStore Engine failed to load local...
|---- 5473 - PAStore Engine loaded directory...
|---- 5474 - PAStore Engine failed to load...
|---- 5477 - PAStore Engine failed to add quick...
|---- 5478 - IPsec Services has started...
|---- 5479 - IPsec Services has been shut down...
|---- 5480 - IPsec Services failed to get the...
|---- 5483 - IPsec Services failed to initialize...
|---- 5484 - IPsec Services has experienced a...
|---- 5485 - IPsec Services failed to process some...
|---- 5632 - A request was made to authenticate to...
|---- 5633 - A request was made to authenticate to...
|---- 5712 - A Remote Procedure Call (RPC) was...
|---- 5888 - An object in the COM+ Catalog was...
|---- 5889 - An object was deleted from the COM+...
|---- 5890 - An object was added to the COM+...
|---- 6144 - Security policy in the group policy...
|---- 6145 - One or more errors occured while...
|---- 6272 - Network Policy Server granted access...
|---- 6273 - Network Policy Server denied access to...
|---- 6274 - Network Policy Server discarded the...
|---- 6275 - Network Policy Server discarded the...
|---- 6276 - Network Policy Server quarantined a...
|---- 6277 - Network Policy Server granted access...
|---- 6278 - Network Policy Server granted full...
|---- 6279 - Network Policy Server locked the user...
|---- 6280 - Network Policy Server unlocked the...
|---- 24001 - Login succeeded
|---- 24002 - Logout succeeded
|---- 24003 - Login failed
|---- 24004 - Change own password succeeded
|---- 24005 - Change own password failed
|---- 24006 - Change password succeeded
|---- 24007 - Change password failed
|---- 24008 - Reset own password succeeded
|---- 24009 - Reset own password failed
|---- 24010 - Reset password succeeded
|---- 24011 - Reset password failed
|---- 24012 - Must change password
|---- 24013 - Account unlocked
|---- 24014 - Change application role password...
|---- 24015 - Change application role password...
|---- 24016 - Add member to server role succeeded
|---- 24017 - Add member to server role failed
|---- 24018 - Remove member from server role...
|---- 24019 - Remove member from server role failed...
|---- 24020 - Add member to database role succeeded...
|---- 24021 - Add member to database role failed
|---- 24022 - Remove member from database role...
|---- 24023 - Remove member from database role...
|---- 24024 - Issued database backup command
|---- 24025 - Issued transaction log backup command...
|---- 24026 - Issued database restore command
|---- 24027 - Issued tranaction log restore command...
|---- 24028 - Issued database console command
|---- 24029 - Issued a bulk administration command
|---- 24030 - Issued an alter connection command
|---- 24031 - Issued an alter resources command
|---- 24032 - Issued an alter server state command
|---- 24033 - Issued an alter server settings...
|---- 24034 - Issued a view server state command
|---- 24035 - Issued an external access assembly...
|---- 24036 - Issued an unsafe assembly command
|---- 24037 - Issued an alter resource governor...
|---- 24038 - Issued a database authenticate...
|---- 24039 - Issued a database checkpoint command
|---- 24040 - Issued a database show plan command
|---- 24041 - Issued a subscribe to query...
|---- 24042 - Issued a view database state command
|---- 24043 - Issued a change server audit command
|---- 24044 - Issued a change server audit...
|---- 24045 - Issued a change database audit...
|---- 24046 - Issued a create server audit command
|---- 24047 - Issued a create server audit...
|---- 24048 - Issued a created database audit...
|---- 24049 - Issued a delete server audit command
|---- 24050 - Issued a delete server audit...
|---- 24051 - Issued a delete database audit...
|---- 24052 - Audit failure
|---- 24053 - Audit session changed
|---- 24054 - Started SQL server
|---- 24055 - Paused SQL server
|---- 24056 - Resumed SQL server
|---- 24057 - Stopped SQL server
|---- 24058 - Issued a create server object command...
|---- 24059 - Issued a change server object command...
|---- 24060 - Issued a delete server object command...
|---- 24061 - Issued a create server setting...
|---- 24062 - Issued a change server setting...
|---- 24063 - Issued a delete server setting...
|---- 24064 - Issued a create server cryptographic...
|---- 24065 - Issued a delete server cryptographic...
|---- 24066 - Issued a change server cryptographic...
|---- 24067 - Issued a create server credential...
|---- 24068 - Issued a delete server credential...
|---- 24069 - Issued a change server credential...
|---- 24070 - Issued a change server master key...
|---- 24071 - Issued a back up server master key...
|---- 24072 - Issued a restore server master key...
|---- 24073 - Issued a map server credential to...
|---- 24074 - Issued a remove map between server...
|---- 24075 - Issued a create server principal...
|---- 24076 - Issued a delete server principal...
|---- 24077 - Issued a change server principal...
|---- 24078 - Issued a disable server principal...
|---- 24079 - Issued a change server principal...
|---- 24080 - Issued an enable server principal...
|---- 24081 - Issued a change server principal...
|---- 24082 - Issued a change server principal...
|---- 24083 - Issued a change server principal...
|---- 24084 - Issued a change server principal name...
|---- 24085 - Issued a create database command
|---- 24086 - Issued a change database command
|---- 24087 - Issued a delete database command
|---- 24088 - Issued a create certificate command
|---- 24089 - Issued a change certificate command
|---- 24090 - Issued a delete certificate command
|---- 24091 - Issued a back up certificate command
|---- 24092 - Issued an access certificate command
|---- 24093 - Issued a create asymmetic key command...
|---- 24094 - Issued a change asymmetic key command...
|---- 24095 - Issued a delete asymmetic key command...
|---- 24096 - Issued an access asymmetic key...
|---- 24097 - Issued a create database master key...
|---- 24098 - Issued a change database master key...
|---- 24099 - Issued a delete database master key...
|---- 24100 - Issued a back up database master key...
|---- 24101 - Issued a restore database master key...
|---- 24102 - Issued an open database master key...
|---- 24103 - Issued a create database symmetric...
|---- 24104 - Issued a change database symmetric...
|---- 24105 - Issued a delete database symmetric...
|---- 24106 - Issued a back up database symmetric...
|---- 24107 - Issued an open database symmetric key...
|---- 24108 - Issued a create database object...
|---- 24109 - Issued a change database object...
|---- 24110 - Issued a delete database object...
|---- 24111 - Issued an access database object...
|---- 24112 - Issued a create assembly command
|---- 24113 - Issued a change assembly command
|---- 24114 - Issued a delete assembly command
|---- 24115 - Issued a create schema command
|---- 24116 - Issued a change schema command
|---- 24117 - Issued a delete schema command
|---- 24118 - Issued a create database encryption...
|---- 24119 - Issued a change database encryption...
|---- 24120 - Issued a delete database encryption...
|---- 24121 - Issued a create database user command...
|---- 24122 - Issued a change database user command...
|---- 24123 - Issued a delete database user command...
|---- 24124 - Issued a create database role command...
|---- 24125 - Issued a change database role command...
|---- 24126 - Issued a delete database role command...
|---- 24127 - Issued a create application role...
|---- 24128 - Issued a change application role...
|---- 24129 - Issued a delete application role...
|---- 24130 - Issued a change database user login...
|---- 24131 - Issued an auto-change database user...
|---- 24132 - Issued a create schema object command...
|---- 24133 - Issued a change schema object command...
|---- 24134 - Issued a delete schema object command...
|---- 24135 - Issued a transfer schema object...
|---- 24136 - Issued a create schema type command
|---- 24137 - Issued a change schema type command
|---- 24138 - Issued a delete schema type command
|---- 24139 - Issued a transfer schema type command...
|---- 24140 - Issued a create XML schema collection...
|---- 24141 - Issued a change XML schema collection...
|---- 24142 - Issued a delete XML schema collection...
|---- 24143 - Issued a transfer XML schema...
|---- 24144 - Issued an impersonate within server...
|---- 24145 - Issued an impersonate within database...
|---- 24146 - Issued a change server object owner...
|---- 24147 - Issued a change database owner...
|---- 24148 - Issued a change schema owner command
|---- 24150 - Issued a change role owner command
|---- 24151 - Issued a change database object owner...
|---- 24152 - Issued a change symmetric key owner...
|---- 24153 - Issued a changed certificate owner...
|---- 24154 - Issued a change asymmetric key owner...
|---- 24155 - Issued a change schema object owner...
|---- 24156 - Issued a change schema type owner...
|---- 24157 - Issued a change XML schema collection...
|---- 24158 - Grant server permissions succeeded
|---- 24159 - Grant server permissions failed
|---- 24160 - Grant server permissions with grant...
|---- 24161 - Grant server permissions with grant...
|---- 24162 - Deny server permissions succeeded
|---- 24163 - Deny server permissions failed
|---- 24164 - Deny server permissions with cascade...
|---- 24165 - Deny server permissions with cascade...
|---- 24166 - Revoke server permissions succeeded
|---- 24167 - Revoke server permissions failed
|---- 24168 - Revoke server permissions with grant...
|---- 24169 - Revoke server permissions with grant...
|---- 24170 - Revoke server permissions with...
|---- 24171 - Revoke server permissions with...
|---- 24172 - Issued grant server object...
|---- 24173 - Issued grant server object...
|---- 24174 - Issued deny server object permissions...
|---- 24175 - Issued deny server object permissions...
|---- 24176 - Issued revoke server object...
|---- 24177 - Issued revoke server object...
|---- 24178 - Issued revoke server object...
|---- 24179 - Grant database permissions succeeded
|---- 24180 - Grant database permissions failed
|---- 24181 - Grant database permissions with grant...
|---- 24182 - Grant database permissions with grant...
|---- 24183 - Deny database permissions succeeded
|---- 24184 - Deny database permissions failed
|---- 24185 - Deny database permissions with...
|---- 24186 - Deny database permissions with...
|---- 24187 - Revoke database permissions succeeded...
|---- 24188 - Revoke database permissions failed
|---- 24189 - Revoke database permissions with...
|---- 24190 - Revoke database permissions with...
|---- 24191 - Revoke database permissions with...
|---- 24192 - Revoke database permissions with...
|---- 24193 - Issued grant database object...
|---- 24194 - Issued grant database object...
|---- 24195 - Issued deny database object...
|---- 24196 - Issued deny database object...
|---- 24197 - Issued revoke database object...
|---- 24198 - Issued revoke database object...
|---- 24199 - Issued revoke database object...
|---- 24200 - Issued grant schema permissions...
|---- 24201 - Issued grant schema permissions with...
|---- 24202 - Issued deny schema permissions...
|---- 24203 - Issued deny schema permissions with...
|---- 24204 - Issued revoke schema permissions...
|---- 24205 - Issued revoke schema permissions with...
|---- 24206 - Issued revoke schema permissions with...
|---- 24207 - Issued grant assembly permissions...
|---- 24208 - Issued grant assembly permissions...
|---- 24209 - Issued deny assembly permissions...
|---- 24210 - Issued deny assembly permissions with...
|---- 24211 - Issued revoke assembly permissions...
|---- 24212 - Issued revoke assembly permissions...
|---- 24213 - Issued revoke assembly permissions...
|---- 24214 - Issued grant database role...
|---- 24215 - Issued grant database role...
|---- 24216 - Issued deny database role permissions...
|---- 24217 - Issued deny database role permissions...
|---- 24218 - Issued revoke database role...
|---- 24219 - Issued revoke database role...
|---- 24220 - Issued revoke database role...
|---- 24221 - Issued grant application role...
|---- 24222 - Issued grant application role...
|---- 24223 - Issued deny application role...
|---- 24224 - Issued deny application role...
|---- 24225 - Issued revoke application role...
|---- 24226 - Issued revoke application role...
|---- 24227 - Issued revoke application role...
|---- 24228 - Issued grant symmetric key...
|---- 24229 - Issued grant symmetric key...
|---- 24230 - Issued deny symmetric key permissions...
|---- 24231 - Issued deny symmetric key permissions...
|---- 24232 - Issued revoke symmetric key...
|---- 24233 - Issued revoke symmetric key...
|---- 24234 - Issued revoke symmetric key...
|---- 24235 - Issued grant certificate permissions...
|---- 24236 - Issued grant certificate permissions...
|---- 24237 - Issued deny certificate permissions...
|---- 24238 - Issued deny certificate permissions...
|---- 24239 - Issued revoke certificate permissions...
|---- 24240 - Issued revoke certificate permissions...
|---- 24241 - Issued revoke certificate permissions...
|---- 24242 - Issued grant asymmetric key...
|---- 24243 - Issued grant asymmetric key...
|---- 24244 - Issued deny asymmetric key...
|---- 24245 - Issued deny asymmetric key...
|---- 24246 - Issued revoke asymmetric key...
|---- 24247 - Issued revoke asymmetric key...
|---- 24248 - Issued revoke asymmetric key...
|---- 24249 - Issued grant schema object...
|---- 24250 - Issued grant schema object...
|---- 24251 - Issued deny schema object permissions...
|---- 24252 - Issued deny schema object permissions...
|---- 24253 - Issued revoke schema object...
|---- 24254 - Issued revoke schema object...
|---- 24255 - Issued revoke schema object...
|---- 24256 - Issued grant schema type permissions...
|---- 24257 - Issued grant schema type permissions...
|---- 24258 - Issued deny schema type permissions...
|---- 24259 - Issued deny schema type permissions...
|---- 24260 - Issued revoke schema type permissions...
|---- 24261 - Issued revoke schema type permissions...
|---- 24262 - Issued revoke schema type permissions...
|---- 24263 - Issued grant XML schema collection...
|---- 24264 - Issued grant XML schema collection...
|---- 24265 - Issued deny XML schema collection...
|---- 24266 - Issued deny XML schema collection...
|---- 24267 - Issued revoke XML schema collection...
|---- 24268 - Issued revoke XML schema collection...
|---- 24269 - Issued revoke XML schema collection...
|---- 24270 - Issued reference database object...
|---- 24271 - Issued send service request command
|---- 24272 - Issued check permissions with schema...
|---- 24273 - Issued use service broker transport...
|---- 24274 - Issued use database mirroring...
|---- 24275 - Issued alter trace command
|---- 24276 - Issued start trace command
|---- 24277 - Issued stop trace command
|---- 24278 - Issued enable trace C2 audit mode...
|---- 24279 - Issued disable trace C2 audit mode...
|---- 24280 - Issued server full-text command
|---- 24281 - Issued select command
|---- 24282 - Issued update command
|---- 24283 - Issued insert command
|---- 24284 - Issued delete command
|---- 24285 - Issued execute command
|---- 24286 - Issued receive command
|---- 24287 - Issued check references command
|---- 24349 - Issued a change assembly owner...
|-- Windows Security Settings
Training Course Forums
All times are GMT -5:00, Time now is 10:27am
Upcoming Webinars
AD Audits: Top 7 Questions to Answer When Auditors Look at Account Management and Access Control in Active Directory
Additional Resources
Security Log Quick Reference Chart
Learn about the SharePoint Audit Log
Security Log Resource Kit
Patch Tuesday Analysis
Workstation Configuration Management
Home
>
Forum
User name:
Password:
/
Forgot?
Register
Home