Event ID |
Type |
Description |
512 |
Success Audit |
Windows NT is starting up. |
513 |
Success Audit |
Windows NT is shutting down. All logon sessions
will be
terminated by this shutdown. |
514 |
Success Audit |
An authentication package has been loaded by the
Local
Security Authority. This authentication package will be
used to authenticate logon attempts. |
515 |
Success Audit |
A trusted logon process has registered with the
Local
Security Authority. This logon process will be trusted to
submit logon requests. |
516 |
Success Audit |
Internal resources allocated for the queuing of
audit
messages have been exhausted, leading to the loss of some
audits. |
517 |
Success Audit |
The audit log was cleared |
518 |
Success Audit |
A notification package has been loaded by the
Security
Account Manager. This package will be notified of any
account or password changes. |
528 |
Success Audit |
Successful Logon |
529 |
Failure Audit |
Logon Failure:
Reason: Unknown user name or bad password |
530 |
Failure Audit |
Logon Failure:
Reason: Account logon time restriction violation |
531 |
Failure Audit |
Logon Failure:
Reason: Account currently disabled |
532 |
Failure Audit |
Logon Failure:
Reason: The specified user account has expired |
533 |
Failure Audit |
Logon Failure:
Reason: User not allowed to logon at this computer |
534 |
Failure Audit |
Logon Failure:
Reason: The user has not been granted the requested logon |
535 |
Failure Audit |
Logon Failure:
Reason: The specified account's password has expired |
536 |
Failure Audit |
Logon Failure:
Reason: The NetLogon component is not active |
537 |
Failure Audit |
Logon Failure:
Reason: The NetLogon component is not active |
538 |
Success Audit |
User Logoff |
539 |
Failure Audit |
Logon Failure:
Reason: Account locked out |
560 |
Success Audit |
Object Open |
561 |
Success Audit |
Handle Allocated |
562 |
Success Audit |
Handle Closed |
563 |
Success Audit |
Object Open for Delete |
564 |
Success Audit |
Object Deleted |
576 |
Success Audit |
Special privileges assigned to new logon |
577 |
Success Audit |
Privileged Service Called |
578 |
Success Audit |
Privileged object operation |
592 |
Success Audit |
A new process has been created |
593 |
Success Audit |
A process has exited |
594 |
Success Audit |
A handle to an object has been duplicated |
595 |
Success Audit |
Indirect access to an object has been obtained |
608 |
Success Audit |
User Right Assigned |
609 |
Success Audit |
User Right Removed |
610 |
Success Audit |
New Trusted Domain |
611 |
Success Audit |
Removing Trusted Domain |
612 |
Success Audit |
Audit Policy Change |
624 |
Success Audit |
User Account Created |
625 |
Success Audit |
User Account Type Change |
626 |
Success Audit |
User Account Enabled |
627 |
Success Audit |
Change Password Attempt |
628 |
Success Audit |
User Account password set |
629 |
Success Audit |
User Account Disabled |
630 |
Success Audit |
User Account Deleted |
631 |
Success Audit |
Global Group Created |
632 |
Success Audit |
Global Group Member Added |
633 |
Success Audit |
Global Group Member Removed |
634 |
Success Audit |
Global Group Deleted |
635 |
Success Audit |
Local Group Created |
636 |
Success Audit |
Local Group Member Added |
637 |
Success Audit |
Local Group Member Removed |
638 |
Success Audit |
Local Group Deleted |
639 |
Success Audit |
Local Group Changed |
640 |
Success Audit |
General Account Database Change |
641 |
Success Audit |
Global Group Changed |
642 |
Success Audit |
User Account Changed |
643 |
Success Audit |
Domain Policy Changed |
644 |
Success Audit |
User Account Locked Out |