| Event ID |
Type |
Description |
| 512 |
Success Audit |
Windows NT is starting up. |
| 513 |
Success Audit |
Windows NT is shutting down. All logon sessions
will be
terminated by this shutdown. |
| 514 |
Success Audit |
An authentication package has been loaded by the
Local
Security Authority. This authentication package will be
used to authenticate logon attempts. |
| 515 |
Success Audit |
A trusted logon process has registered with the
Local
Security Authority. This logon process will be trusted to
submit logon requests. |
| 516 |
Success Audit |
Internal resources allocated for the queuing of
audit
messages have been exhausted, leading to the loss of some
audits. |
| 517 |
Success Audit |
The audit log was cleared |
| 518 |
Success Audit |
A notification package has been loaded by the
Security
Account Manager. This package will be notified of any
account or password changes. |
| 528 |
Success Audit |
Successful Logon |
| 529 |
Failure Audit |
Logon Failure:
Reason: Unknown user name or bad password |
| 530 |
Failure Audit |
Logon Failure:
Reason: Account logon time restriction violation |
| 531 |
Failure Audit |
Logon Failure:
Reason: Account currently disabled |
| 532 |
Failure Audit |
Logon Failure:
Reason: The specified user account has expired |
| 533 |
Failure Audit |
Logon Failure:
Reason: User not allowed to logon at this computer |
| 534 |
Failure Audit |
Logon Failure:
Reason: The user has not been granted the requested logon |
| 535 |
Failure Audit |
Logon Failure:
Reason: The specified account's password has expired |
| 536 |
Failure Audit |
Logon Failure:
Reason: The NetLogon component is not active |
| 537 |
Failure Audit |
Logon Failure:
Reason: The NetLogon component is not active |
| 538 |
Success Audit |
User Logoff |
| 539 |
Failure Audit |
Logon Failure:
Reason: Account locked out |
| 560 |
Success Audit |
Object Open |
| 561 |
Success Audit |
Handle Allocated |
| 562 |
Success Audit |
Handle Closed |
| 563 |
Success Audit |
Object Open for Delete |
| 564 |
Success Audit |
Object Deleted |
| 576 |
Success Audit |
Special privileges assigned to new logon |
| 577 |
Success Audit |
Privileged Service Called |
| 578 |
Success Audit |
Privileged object operation |
| 592 |
Success Audit |
A new process has been created |
| 593 |
Success Audit |
A process has exited |
| 594 |
Success Audit |
A handle to an object has been duplicated |
| 595 |
Success Audit |
Indirect access to an object has been obtained |
| 608 |
Success Audit |
User Right Assigned |
| 609 |
Success Audit |
User Right Removed |
| 610 |
Success Audit |
New Trusted Domain |
| 611 |
Success Audit |
Removing Trusted Domain |
| 612 |
Success Audit |
Audit Policy Change |
| 624 |
Success Audit |
User Account Created |
| 625 |
Success Audit |
User Account Type Change |
| 626 |
Success Audit |
User Account Enabled |
| 627 |
Success Audit |
Change Password Attempt |
| 628 |
Success Audit |
User Account password set |
| 629 |
Success Audit |
User Account Disabled |
| 630 |
Success Audit |
User Account Deleted |
| 631 |
Success Audit |
Global Group Created |
| 632 |
Success Audit |
Global Group Member Added |
| 633 |
Success Audit |
Global Group Member Removed |
| 634 |
Success Audit |
Global Group Deleted |
| 635 |
Success Audit |
Local Group Created |
| 636 |
Success Audit |
Local Group Member Added |
| 637 |
Success Audit |
Local Group Member Removed |
| 638 |
Success Audit |
Local Group Deleted |
| 639 |
Success Audit |
Local Group Changed |
| 640 |
Success Audit |
General Account Database Change |
| 641 |
Success Audit |
Global Group Changed |
| 642 |
Success Audit |
User Account Changed |
| 643 |
Success Audit |
Domain Policy Changed |
| 644 |
Success Audit |
User Account Locked Out |