A rchive Date
[ 04-10-2000 ]
Category
[ Information Technologies ]
sub-Categoy
[ Microsoft ]

http://www.ntfaq.com/Articles/Index.cfm?ArticleID=15361

Q. Where are the Security event ID's listed?

A. There are defined in Knowledge base article Q174074 at http://www.microsoft.com/technet/support/searchkb.asp. I've created a table below which makes them easier to view.

Event ID	Type	Description
512	Success Audit	Windows NT is starting up.
513	Success Audit	Windows NT is shutting down. All logon sessions will be terminated by this shutdown.
514	Success Audit	An authentication package has been loaded by the Local Security Authority. This authentication package will be used to authenticate logon attempts.
515	Success Audit	A trusted logon process has registered with the Local Security Authority. This logon process will be trusted to submit logon requests.
516	Success Audit	Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits.
517	Success Audit	The audit log was cleared
518	Success Audit	A notification package has been loaded by the Security Account Manager. This package will be notified of any account or password changes.
528	Success Audit	Successful Logon
529	Failure Audit	Logon Failure: Reason: Unknown user name or bad password
530	Failure Audit	Logon Failure: Reason: Account logon time restriction violation
531	Failure Audit	Logon Failure: Reason: Account currently disabled
532	Failure Audit	Logon Failure: Reason: The specified user account has expired
533	Failure Audit	Logon Failure: Reason: User not allowed to logon at this computer
534	Failure Audit	Logon Failure: Reason: The user has not been granted the requested logon
535	Failure Audit	Logon Failure: Reason: The specified account's password has expired
536	Failure Audit	Logon Failure: Reason: The NetLogon component is not active
537	Failure Audit	Logon Failure: Reason: The NetLogon component is not active
538	Success Audit	User Logoff
539	Failure Audit	Logon Failure: Reason: Account locked out
560	Success Audit	Object Open
561	Success Audit	Handle Allocated
562	Success Audit	Handle Closed
563	Success Audit	Object Open for Delete
564	Success Audit	Object Deleted
576	Success Audit	Special privileges assigned to new logon
577	Success Audit	Privileged Service Called
578	Success Audit	Privileged object operation
592	Success Audit	A new process has been created
593	Success Audit	A process has exited
594	Success Audit	A handle to an object has been duplicated
595	Success Audit	Indirect access to an object has been obtained
608	Success Audit	User Right Assigned
609	Success Audit	User Right Removed
610	Success Audit	New Trusted Domain
611	Success Audit	Removing Trusted Domain
612	Success Audit	Audit Policy Change
624	Success Audit	User Account Created
625	Success Audit	User Account Type Change
626	Success Audit	User Account Enabled
627	Success Audit	Change Password Attempt
628	Success Audit	User Account password set
629	Success Audit	User Account Disabled
630	Success Audit	User Account Deleted
631	Success Audit	Global Group Created
632	Success Audit	Global Group Member Added
633	Success Audit	Global Group Member Removed
634	Success Audit	Global Group Deleted
635	Success Audit	Local Group Created
636	Success Audit	Local Group Member Added
637	Success Audit	Local Group Member Removed
638	Success Audit	Local Group Deleted
639	Success Audit	Local Group Changed
640	Success Audit	General Account Database Change
641	Success Audit	Global Group Changed
642	Success Audit	User Account Changed
643	Success Audit	Domain Policy Changed
644	Success Audit	User Account Locked Out

Cross-Indexed:

Windows 2000 Distributed File System

Some pages may require Adobe Acrobat Reader^™