Windows Security Log Event ID 809

809: A security event source has attempted to unregister

On this page

• Description of this event
• Field level details
• Examples

A process degistered itself as source for reporting events to the security log.  See event ID 808

Free Security Log Resources by Randy

• Free Security Log Quick Reference Chart
• Windows Event Collection: Supercharger Free Edtion
• Free Active Directory Change Auditing Solution
• Free Course: Security Log Secrets

Description Fields in 809

• Primary User Name:
• Primary Domain:
• Primary Logon ID:
• Client User Name:
• Client Domain:
• Client Logon ID:
• Source Name: source name as shown in security log
• Process Id: PID of process that unregistered
• Event Source Id:

Setup PowerShell Audit Log Forwarding in 4 Minutes

 

 

Upcoming Webinars The Changing Landscape of Authentication and Logon Tracking in Hybrid Environments of Entra and AD Understanding REST APIs and Their Security Issues: Secrets, Input Validation, Output Filtering, Call Limits, Automation, Authorization

Additional Resources

•	Event IDs
•	All Event IDs
•	Audit Policy