Windows Event ID Reference

An account was successfully logged on

A logon session was created on this machine. The Logon Type says how (interactive, network, RDP, service…); the New Logon fields say who; the Network Information names where it came from.

An account failed to log on

A logon attempt failed on this machine. The Status / Sub-Status hex code says why; the Logon Type says where. The Sub-Status is usually the precise reason.

An account was logged off

A logon session ended. Pairs with its 4624 by the shared Logon ID. Often arrives long after the user actually left.

User initiated logoff

The user deliberately signed out (Start → Sign out), as opposed to the system tearing the session down.

A logon was attempted using explicit credentials

A process authenticated as someone other than the logged-on user, RunAs, a mapped drive with alternate creds, a scheduled task, or a service connecting out.

Special privileges assigned to new logon

An account logged on holding sensitive privileges (SeDebugPrivilege, SeBackupPrivilege, SeTcbPrivilege…), i.e. an administrator-equivalent session.

A user account was locked out

An account hit the bad-password threshold and was auto-locked. Logged on the PDC-emulator DC. The Caller Computer Name names the machine the bad attempts came from.

A user account was unlocked

A locked account was unlocked by an admin (or its lockout duration elapsed).

A Kerberos authentication ticket (TGT) was requested

An AS-REQ: a principal asked the KDC (a DC) for a Ticket-Granting Ticket, i.e. a domain logon. The Result Code is 0x0 on success, or a Kerberos failure code.

A Kerberos service ticket was requested

A TGS-REQ: a principal requested a service ticket for a specific SPN. Extremely high-volume on busy DCs.

Kerberos pre-authentication failed

AS-REQ pre-auth failed at the KDC, the Kerberos equivalent of a 4625. The Failure Code says why.

The domain controller attempted to validate the credentials for an account

NTLM credential validation (the legacy auth path). Error Code 0x0 = success; non-zero = failure, using the same NTSTATUS-style codes as 4625's sub-status.

A user account was created

A new user account was created, in AD (on a DC) or locally (in SAM).

A user account was enabled

A disabled account was re-enabled.

An attempt was made to change an account's password

A user changed their OWN password (they supplied the old one). Distinct from an admin reset.

An attempt was made to reset an account's password

An administrator RESET another account's password (no knowledge of the old one needed). Different from 4723.

A user account was disabled

An account was disabled.

A user account was deleted

An account was deleted from AD or the local SAM.

A user account was changed

An attribute on a user account changed (UAC flags, name, UPN, scope…). The event lists the changed fields; '-' means unchanged. Noisy.

The name of an account was changed

An account was renamed (sAMAccountName / display name).

A member was added to a security-enabled global group

Someone was added to a GLOBAL security group in AD (e.g. Domain Admins, which is a global group).

A member was removed from a security-enabled global group

A member was removed from a global security group.

A member was added to a security-enabled local group

A member was added to a LOCAL security group, e.g. the local Administrators or Remote Desktop Users group on a server/workstation.

A member was removed from a security-enabled local group

A member was removed from a local security group.

A member was added to a security-enabled universal group

A member was added to a UNIVERSAL security group in AD. The forest-root tier-0 groups Enterprise Admins and Schema Admins are universal groups.

A member was removed from a security-enabled universal group

A member was removed from a universal security group.

The audit log was cleared

The Security event log was cleared. Records the account that cleared it (Subject).

System audit policy was changed

The audit policy (which events get logged) was modified.

The Event log service was started

The Event Log service started, effectively the 'the computer was turned on' marker.

The Event log service was stopped

The Event Log service stopped, the clean-shutdown marker.

The previous system shutdown was unexpected

The last shutdown was not clean, power loss, hard reset, or a crash. Includes the time it went down.

Kernel-Power: the system rebooted without cleanly shutting down first

Kernel-Power 41, Windows detected on the NEXT boot that it had stopped responding, crashed, or lost power instead of shutting down properly. May carry BugcheckCode / PowerButtonTimestamp fields.

The system has been shut down / restarted by a process or user

A clean, initiated shutdown or restart. Records the process (explorer.exe, shutdown.exe, the WU agent…), the user, the shutdown type, and the reason code.

The computer has rebooted from a bugcheck (BSOD)

Logged by WER-SystemErrorReporting after a Stop error: 'The bugcheck was: 0x… A dump was saved in: C:\Windows\MEMORY.DMP.' This is the record of the actual blue screen and its stop code.

A new service was installed in the system

A service was installed. Records the Service Name, the Service File Name (image path), the type, and the start type.

A service terminated unexpectedly

A service crashed (not a planned stop). Includes how many times it has now done so.

A service entered the running / stopped state

A service changed state (started or stopped). Fires for nearly every service transition, very high volume.

Group Policy: cannot access / read gpt.ini for a GPO

The Group Policy engine couldn't read \\domain\SYSVOL\…\<GUID>\gpt.ini. The Details tab carries an error code; processing is aborted for that GPO.

Group Policy: cannot query the list of Group Policy objects

Group Policy couldn't retrieve its GPO list for this user/computer. The companion to 1058; the reason was logged just before by the policy engine.

Netlogon: this computer could not set up a secure session with a domain controller

The machine couldn't establish a Netlogon secure channel to any DC for its domain when it needed one (often at boot). Domain logons, Group Policy and Kerberos all stall until it's restored.

Netlogon: this computer failed to authenticate with a domain controller

Logged on the member machine: it tried to authenticate its computer account to the named DC over the secure channel and was refused. The client-side view of a broken secure channel.

Netlogon: the session setup from a computer failed to authenticate

Logged on a domain controller: a member computer presented a machine-account password the DC rejected. Names the computer account (ending in $), the DC-side view of the same broken secure channel a client logs as 3210.

Netlogon: the session setup from a computer with no trust account failed

Logged on a DC: a computer tried to set up a secure session but there's no matching computer (trust) account for it in the domain, the account was deleted or never existed.

Schannel: a TLS/SSL connection failed, no common cipher suites

The TLS handshake failed because the client and server share no cipher suite (and/or no common protocol version). Logged by Schannel on the side that couldn't agree.

Schannel: a fatal TLS/SSL alert was generated

The local Schannel stack raised a fatal TLS alert and closed the connection. The event includes an alert/error code (e.g. internal error 80, handshake failure 40, bad certificate 42, unknown CA 48).

Disk: the device has a bad block

The disk driver reported a bad block on a physical device (\Device\Harddisk…). The drive couldn't read/write a sector reliably.

Disk: the driver detected a controller error

'The driver detected a controller error on \Device\HarddiskN\DRN.' A low-level I/O error between Windows and the storage device/controller.

Disk: an I/O operation was retried

'The IO operation at logical block address … for Disk N was retried.' Windows had to retry a read/write because the device didn't respond in time.

NTFS: the file system structure on the disk is corrupt and unusable

'The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume.' NTFS detected on-disk corruption.

A network share object was accessed

A network share (e.g. \\server\share) was accessed. Requires the 'Audit File Share' policy. (Categorised under access auditing.)

A network share object was checked to see whether the client can be granted desired access

The detailed file-share audit: for each access to a file/folder on a share it logs the share name, the relative path, and the Access Check Results, the specific rights that were granted or denied. Needs the 'Audit Detailed File Share' subcategory enabled.

LDAP search was expensive / inefficient

A costly LDAP query against AD, high visited/returned entry counts or long duration. Requires the Expensive/Inefficient search diagnostics to be raised.

A client performed an insecure (simple bind / unsigned) LDAP connection

A client connected to AD over LDAP without signing / channel binding (a cleartext simple bind or an unsigned bind). Logs the client IP and the account.