Security Event IDs list
0 = Unused message ID
1 = System Event
2 = Logon/Logoff
3 = Object Access
4 = Privilege Use
5 = Detailed Tracking
6 = Policy Change
7 = Account Management
8 = Directory Service Access
9 = Account Logon
512 = Windows NT is starting up.
513 = Windows NT is shutting down.
514 = An authentication package has been loaded by the Local Security Authority.
515 = A trusted logon process has registered with the Local Security Authority.
516 = Internal resources allocated for the queuing of audit messages have been exhausted
517 = The audit log was cleared
518 = An notification package has been loaded by the Security Account Manager.
528 = Successful Logon
529 = Logon Failure: Unknown user name or bad password
530 = Logon Failure: Account logon time restriction violation
531 = Logon Failure: Account currently disabled
532 = Logon Failure: The specified user account has expired
533 = Logon Failure: User not allowed to logon at this computer
534 = Logon Failure: The user has not been granted the requested logon type at this machine
535 = The specified account\'s password has expired
536 = Logon Failure: The NetLogon component is not active
537 = Logon Failure: An unexpected error occurred during logon
538 = User Logoff
539 = Logon Failure:
540 = Successful Network Logon
541 = IKE security association established.
542 = IKE security association ended : Data Protection
543 = IKE security association ended : Key Exchange544' = IKE security association establishment failed
because peer could not authenticate : The certificate trust coud not be established.
545 = IKE peer authentication failed
546 = IKE security association establishment failed because peer sent invalid proposal.
547 = IKE security association negotiation failed.
560 = Object Open
561 = Handle Allocated
562 = Handle Closed
563 = Object Open for Delete
564 = Object Deleted
565 = Object Open
566 = Object Operation
576 = Special privileges assigned to new logon
577 = Privileged Service Called
578 = Privileged object operation
592 = A new process has been created
593 = A process has exited
594 = A handle to an object has been duplicated
595 = Indirect access to an object has been obtained
608 = User Right Assigned
609 = User Right Removed
610 = New Trusted Domain
611 = Removing Trusted Domain
612 = Audit Policy Change
613 = IPSec policy agent started
614 = IPSec policy agent disabled
615 = IPSec PolicyAgent Service
616 = IPSec policy agent encountered a potentially serious failure.
617 = Kerberos Policy Changed
618 = Encrypted Data Recovery policy Changed
619 = Quality of Service Policy Changed
620 = Trusted Domain Information Modified
624 = User Account Created
625 = User Account Type Change
626 = User Account Enabled
627 = Change Password Attempt
628 = User Account password set
629 = User Account Disabled
630 = User Account Deleted
631 = Security Enabled Global Group Created
632 = Security Enabled Global Group Member Added
633 = Security Enabled Global Group Member Removed
634 = Security Enabled Global Group Deleted
635 = Security Enabled Local Group Created
636 = Security Enabled Local Group Member Added
637 = Security Enabled Local Group Member Removed
638 = Security Enabled Local Group Deleted
639 = Security Enabled Local Group Changed
640 = General Account Database Change
641 = Security Enabled Global Group Changed
642 = User Account Changed
643 = Domain Policy Changed
644 = User Account Locked Out
645 = Computer Account Created
646 = Computer Account Changed
647 = Computer Account Deleted
648 = Security Disabled Local Group Created
649 = Security Disabled Local Group Changed
650 = Security Disabled Local Group Member Added
651 = Security Disabled Local Group Member Removed
652 = Security Disabled Local Group Deleted
653 = Security Disabled Global Group Created
654 = Security Disabled Global Group Changed
655 = Security Disabled Global Group Member Added
656 = Security Disabled Global Group Member Removed
657 = Security Disabled Global Group Deleted
658 = Security Enabled Universal Group Created
659 = Security Enabled Universal Group Changed
660 = Security Enabled Universal Group Member Added
661 = Security Enabled Universal Group Member Removed
662 = Security Enabled Universal Group Deleted
663 = Security Disabled Universal Group Created
664 = Security Disabled Universal Group Changed
665 = Security Disabled Universal Group Member Added
666 = Security Disabled Universal Group Member Removed
667 = Security Disabled Universal Group Deleted
668 = Group Type Changed
669 = Add SID History
670 = Add SID History
672 = Authentication Ticket Granted
673 = Service Ticket Granted
674 = Ticket Granted Renewed
675 = Pre - authentication failed
676 = Authentication Ticket Request Failed
677 = Service Ticket Request Failed
678 = Account Mapped for Logon
679 = Account Mapping for Logon failure
680 = Account Used for Logon
681 = Logon to account failure
682 = Session reconnected to winstation
683 = Session disconnected from winstation