Windows event ID guide

Generated on the computer that was accessed when a logon session is created. Records who logged on, the logon type, the authentication package and, for network logons, the source workstation and address.

Logged for any logon failure on the computer where the attempt was made. Status and SubStatus carry NTSTATUS codes that give the reason, such as a bad password or a disabled account.

Generated when a logon session is terminated and no longer exists.

Generated when an account starts a logoff through the logoff function. It is most typical for interactive and remote interactive logons.

Generated when a process attempts a logon by explicitly specifying an account's credentials, for example with RUNAS or in batch configurations such as scheduled tasks.

Generated when a new logon session receives sensitive privileges such as SeDebugPrivilege, SeBackupPrivilege or SeTcbPrivilege. Every SYSTEM logon also triggers it.

Generated when a user reconnects to an existing Terminal Services session, switches to an existing desktop with Fast User Switching, or reconnects to a Hyper-V Enhanced Session.

Generated when a user disconnects from a Terminal Services session, switches away with Fast User Switching, or disconnects from a Hyper-V Enhanced Session.

Generated every time a new user object is created, on domain controllers, member servers and workstations. Subject fields identify who created it; the remaining fields record the new account's initial attributes.

Generated each time a user or computer object is enabled. For computer accounts it appears only on domain controllers.

Generated when a user attempts to change his or her own password. A failure is logged when the new password does not meet policy (and, for local accounts, when the old password is wrong).

Generated each time an account attempts to reset another account's password, including computer account resets.

Generated every time a user or computer object is disabled. For computer accounts it appears only on domain controllers.

Generated every time a user object is deleted, on domain controllers, member servers and workstations.

Domain-only counterpart of 4732 for global groups. Microsoft documents it as identical to 4732 in fields and XML; only the group type differs.

Generated each time a member is added to a security-enabled local group, such as the built-in Administrators group. Each added member produces a separate event.

Generated each time a user object is changed. Changed attributes carry their new values; unchanged ones show "-".

Generated every time a user account is locked out after exceeding the lockout threshold. On domains it is recorded on the domain controller.

Domain-only counterpart of 4732 for universal groups (for example Enterprise Admins). Microsoft documents the same fields and XML as 4732.

Generated on domain controllers each time the Key Distribution Center issues, or fails to issue, a ticket-granting ticket. Status 0x0 means success.

Generated on domain controllers every time the KDC receives a request for a service ticket (TGS). Failures carry a non-zero Status.

Generated on domain controllers when the KDC fails to issue a TGT because pre-authentication failed. Status 0x18 usually means a wrong password.

Generated on the computer authoritative for the credentials whenever NTLM credential validation succeeds or fails: the domain controller for domain accounts, the local computer for local accounts.

Records a request to open a handle to an audited object and whether it was granted. A failure event is generated when access is declined.

Generated when a registry value is created, modified or deleted under an audited key. Records the old and new value and type.

Records that a specific access right was actually used on an audited object such as a file, registry key or kernel object.

Generated every time a new process starts. Records the executable path, the creating process, the token elevation type and, if enabled by policy, the command line.

Generated every time a process exits. Records the process name, its ID and the exit status.

Logged by Microsoft-Windows-Eventlog in the System log when an event log other than Security (for example System or Application) is cleared. The message names the cleared log.

Generated every time the Windows Security log is cleared. Records the account that cleared it.

Generated when the computer's audit policy changes. Records the category, subcategory and whether success or failure auditing was added or removed.

Logged by Microsoft-Windows-Kernel-Power at startup when the previous session ended without a clean shutdown, for example after a power loss, hang or stop error.

Logged by the User32 source when an application or user initiates a shutdown or restart. The message names the process, the user on whose behalf it acted, the reason, the reason code and the shutdown type.

Generated in the Security log when a new service is installed. Records the service name, binary path, type, start type and account.

Logged by the EventLog source when the Event Log service starts, which in practice marks system startup.

Logged by the EventLog source when the Event Log service stops during an orderly shutdown; Microsoft describes it as indicating that Windows was adequately turned off.

Logged by the EventLog source at the next startup when the previous shutdown was not clean. The message contains the date and time of that shutdown.

Logged by the Service Control Manager when a service terminates unexpectedly and no recovery action is configured. The message gives the service name and how many times it has happened.

Logged by the Service Control Manager when a service enters a new state, for example running or stopped.

Logged by the Service Control Manager when a service's start type changes, for example from automatic to disabled.

Logged by the Service Control Manager when a service is installed. Microsoft Defender for Identity lists it as a required event ("New Service Installed").

Logged by Microsoft-Windows-TaskScheduler when a user registers (creates) a task. The message names the task and the user.

Logged when Task Scheduler launches an action in an instance of a task. The message names the task, the action and the instance.

Logged when Task Scheduler successfully completes an action of a task instance.

Generated every time a new scheduled task is created. TaskContent contains the full task XML, including triggers, actions and the account it runs as.

Generated every time a scheduled task is deleted. TaskContent holds the XML definition of the deleted task.

Generated every time a scheduled task is updated or changed. TaskContentNew holds the new XML definition.

When Script Block Logging is enabled, Windows PowerShell records the content of the script blocks it processes in this event.

Logged by the Local Session Manager when a session logon succeeds. The message gives the user, session ID and source network address.

Logged when a session is disconnected. The message gives the user, session ID and source network address.

Logged when a user reconnects to an existing session. The message gives the user, session ID and source network address.

Microsoft Defender Antivirus detected malware or potentially unwanted software. Records the threat name, severity, path, detection source, user and process.

Microsoft Defender Antivirus took an action (such as quarantine or remove) on detected software. Records the action, its status and any error.