Find knowledge base article(s) by searching for keywords in the title e.g. type linux in the search box below

Find knowledge base article(s) by browsing the subject categories of articles

Technology quick references, cheatsheets, user manuals etc.

Shop Online through ShopifyLite

Tutorials on various IT applications.

What are the security event IDs

Security Event IDs list 0 = Unused message ID 1 = System Event 2 = Logon/Logoff 3 = Object Access 4 = Privilege Use 5 = Detailed Tracking 6 = Policy Change 7 = Account Management 8 = Directory Service Access 9 = Account Logon 512 = Windows NT is starting up. 513 = Windows NT is shutting down. 514 = An authentication package has been loaded by the Local Security Authority. 515 = A trusted logon process has registered with the Local Security Authority. 516 = Internal resources allocated for the queuing of audit messages have been exhausted 517 = The audit log was cleared 518 = An notification package has been loaded by the Security Account Manager. 528 = Successful Logon 529 = Logon Failure: Unknown user name or bad password 530 = Logon Failure: Account logon time restriction violation 531 = Logon Failure: Account currently disabled 532 = Logon Failure: The specified user account has expired 533 = Logon Failure: User not allowed to logon at this computer 534 = Logon Failure: The user has not been granted the requested logon type at this machine 535 = The specified account\'s password has expired 536 = Logon Failure: The NetLogon component is not active 537 = Logon Failure: An unexpected error occurred during logon 538 = User Logoff 539 = Logon Failure: 540 = Successful Network Logon 541 = IKE security association established. 542 = IKE security association ended : Data Protection 543 = IKE security association ended : Key Exchange544' = IKE security association establishment failed because peer could not authenticate : The certificate trust coud not be established. 545 = IKE peer authentication failed 546 = IKE security association establishment failed because peer sent invalid proposal. 547 = IKE security association negotiation failed. 560 = Object Open 561 = Handle Allocated 562 = Handle Closed 563 = Object Open for Delete 564 = Object Deleted 565 = Object Open 566 = Object Operation 576 = Special privileges assigned to new logon 577 = Privileged Service Called 578 = Privileged object operation 592 = A new process has been created 593 = A process has exited 594 = A handle to an object has been duplicated 595 = Indirect access to an object has been obtained 608 = User Right Assigned 609 = User Right Removed 610 = New Trusted Domain 611 = Removing Trusted Domain 612 = Audit Policy Change 613 = IPSec policy agent started 614 = IPSec policy agent disabled 615 = IPSec PolicyAgent Service 616 = IPSec policy agent encountered a potentially serious failure. 617 = Kerberos Policy Changed 618 = Encrypted Data Recovery policy Changed 619 = Quality of Service Policy Changed 620 = Trusted Domain Information Modified 624 = User Account Created 625 = User Account Type Change 626 = User Account Enabled 627 = Change Password Attempt 628 = User Account password set 629 = User Account Disabled 630 = User Account Deleted 631 = Security Enabled Global Group Created 632 = Security Enabled Global Group Member Added 633 = Security Enabled Global Group Member Removed 634 = Security Enabled Global Group Deleted 635 = Security Enabled Local Group Created 636 = Security Enabled Local Group Member Added 637 = Security Enabled Local Group Member Removed 638 = Security Enabled Local Group Deleted 639 = Security Enabled Local Group Changed 640 = General Account Database Change 641 = Security Enabled Global Group Changed 642 = User Account Changed 643 = Domain Policy Changed 644 = User Account Locked Out 645 = Computer Account Created 646 = Computer Account Changed 647 = Computer Account Deleted 648 = Security Disabled Local Group Created 649 = Security Disabled Local Group Changed 650 = Security Disabled Local Group Member Added 651 = Security Disabled Local Group Member Removed 652 = Security Disabled Local Group Deleted 653 = Security Disabled Global Group Created 654 = Security Disabled Global Group Changed 655 = Security Disabled Global Group Member Added 656 = Security Disabled Global Group Member Removed 657 = Security Disabled Global Group Deleted 658 = Security Enabled Universal Group Created 659 = Security Enabled Universal Group Changed 660 = Security Enabled Universal Group Member Added 661 = Security Enabled Universal Group Member Removed 662 = Security Enabled Universal Group Deleted 663 = Security Disabled Universal Group Created 664 = Security Disabled Universal Group Changed 665 = Security Disabled Universal Group Member Added 666 = Security Disabled Universal Group Member Removed 667 = Security Disabled Universal Group Deleted 668 = Group Type Changed 669 = Add SID History 670 = Add SID History 672 = Authentication Ticket Granted 673 = Service Ticket Granted 674 = Ticket Granted Renewed 675 = Pre - authentication failed 676 = Authentication Ticket Request Failed 677 = Service Ticket Request Failed 678 = Account Mapped for Logon 679 = Account Mapping for Logon failure 680 = Account Used for Logon 681 = Logon to account failure 682 = Session reconnected to winstation 683 = Session disconnected from winstation