Software >> OS >> Windows >> Event Viewer >> What are the security event IDs

Security Event IDs list 0 = Unused message ID 1 = System Event 2 = Logon/Logoff 3 = Object Access 4 = Privilege Use 5 = Detailed Tracking 6 = Policy Change 7 = Account Management 8 = Directory Service Access 9 = Account Logon 512 = Windows NT is starting up. 513 = Windows NT is shutting down. 514 = An authentication package has been loaded by the Local Security Authority. 515 = A trusted logon process has registered with the Local Security Authority. 516 = Internal resources allocated for the queuing of audit messages have been exhausted 517 = The audit log was cleared 518 = An notification package has been loaded by the Security Account Manager. 528 = Successful Logon 529 = Logon Failure: Unknown user name or bad password 530 = Logon Failure: Account logon time restriction violation 531 = Logon Failure: Account currently disabled 532 = Logon Failure: The specified user account has expired 533 = Logon Failure: User not allowed to logon at this computer 534 = Logon Failure: The user has not been granted the requested logon type at this machine 535 = The specified account\'s password has expired 536 = Logon Failure: The NetLogon component is not active 537 = Logon Failure: An unexpected error occurred during logon 538 = User Logoff 539 = Logon Failure: 540 = Successful Network Logon 541 = IKE security association established. 542 = IKE security association ended : Data Protection 543 = IKE security association ended : Key Exchange544' = IKE security association establishment failed because peer could not authenticate : The certificate trust coud not be established. 545 = IKE peer authentication failed 546 = IKE security association establishment failed because peer sent invalid proposal. 547 = IKE security association negotiation failed. 560 = Object Open 561 = Handle Allocated 562 = Handle Closed 563 = Object Open for Delete 564 = Object Deleted 565 = Object Open 566 = Object Operation 576 = Special privileges assigned to new logon 577 = Privileged Service Called 578 = Privileged object operation 592 = A new process has been created 593 = A process has exited 594 = A handle to an object has been duplicated 595 = Indirect access to an object has been obtained 608 = User Right Assigned 609 = User Right Removed 610 = New Trusted Domain 611 = Removing Trusted Domain 612 = Audit Policy Change 613 = IPSec policy agent started 614 = IPSec policy agent disabled 615 = IPSec PolicyAgent Service 616 = IPSec policy agent encountered a potentially serious failure. 617 = Kerberos Policy Changed 618 = Encrypted Data Recovery policy Changed 619 = Quality of Service Policy Changed 620 = Trusted Domain Information Modified 624 = User Account Created 625 = User Account Type Change 626 = User Account Enabled 627 = Change Password Attempt 628 = User Account password set 629 = User Account Disabled 630 = User Account Deleted 631 = Security Enabled Global Group Created 632 = Security Enabled Global Group Member Added 633 = Security Enabled Global Group Member Removed 634 = Security Enabled Global Group Deleted 635 = Security Enabled Local Group Created 636 = Security Enabled Local Group Member Added 637 = Security Enabled Local Group Member Removed 638 = Security Enabled Local Group Deleted 639 = Security Enabled Local Group Changed 640 = General Account Database Change 641 = Security Enabled Global Group Changed 642 = User Account Changed 643 = Domain Policy Changed 644 = User Account Locked Out 645 = Computer Account Created 646 = Computer Account Changed 647 = Computer Account Deleted 648 = Security Disabled Local Group Created 649 = Security Disabled Local Group Changed 650 = Security Disabled Local Group Member Added 651 = Security Disabled Local Group Member Removed 652 = Security Disabled Local Group Deleted 653 = Security Disabled Global Group Created 654 = Security Disabled Global Group Changed 655 = Security Disabled Global Group Member Added 656 = Security Disabled Global Group Member Removed 657 = Security Disabled Global Group Deleted 658 = Security Enabled Universal Group Created 659 = Security Enabled Universal Group Changed 660 = Security Enabled Universal Group Member Added 661 = Security Enabled Universal Group Member Removed 662 = Security Enabled Universal Group Deleted 663 = Security Disabled Universal Group Created 664 = Security Disabled Universal Group Changed 665 = Security Disabled Universal Group Member Added 666 = Security Disabled Universal Group Member Removed 667 = Security Disabled Universal Group Deleted 668 = Group Type Changed 669 = Add SID History 670 = Add SID History 672 = Authentication Ticket Granted 673 = Service Ticket Granted 674 = Ticket Granted Renewed 675 = Pre - authentication failed 676 = Authentication Ticket Request Failed 677 = Service Ticket Request Failed 678 = Account Mapped for Logon 679 = Account Mapping for Logon failure 680 = Account Used for Logon 681 = Logon to account failure 682 = Session reconnected to winstation 683 = Session disconnected from winstation