2 Mart 2012 Cuma

Windows 2003 Security Event IDs


Event ID: 512
Type: Success Audit
Description: Windows NT is starting up.

Event ID: 513
Type: Success Audit
Description: Windows NT is shutting down. All logon sessions will be
terminated by this shutdown.

Event ID: 514
Type: Success Audit
Description: An authentication package has been loaded by the Local
Security Authority. This authentication package will be
used to authenticate logon attempts.

Event ID: 515
Type: Success Audit
Description: A trusted logon process has registered with the Local
Security Authority. This logon process will be trusted to
submit logon requests.


Event ID: 516
Type: Success Audit
Description: Internal resources allocated for the queuing of audit
messages have been exhausted, leading to the loss of some
audits.

Event ID: 517
Type: Success Audit
Description: The audit log was cleared

Event ID: 518
Type: Success Audit
Description: A notification package has been loaded by the Security
Account Manager. This package will be notified of any
account or password changes.
Event ID: 528
Type: Success Audit
Description: Successful Logon:

Event ID: 529
Type: Failure Audit
Description: Logon Failure:
Reason: Unknown user name or bad password


Event ID: 530
Type: Failure Audit
Description: Logon Failure:
Reason: Account logon time restriction violation

Event ID: 531
Type: Failure Audit
Description: Logon Failure:
Reason: Account currently disabled

Event ID: 532
Type: Failure Audit
Description: Logon Failure:
Reason: The specified user account has expired

Event ID: 533
Type: Failure Audit
Description: Logon Failure:
Reason: User not allowed to logon at this computer

Event ID: 534
Type: Failure Audit
Description: Logon Failure:
Reason: The user has not been granted the requested logon
type at this machine


Event ID: 535
Type: Failure Audit
Description: Logon Failure

Event ID: 536
Type: Failure Audit
Description: Logon Failure:
Reason: The NetLogon component is not active

Event ID: 537
Type: Failure Audit
Description: Logon Failure:
Reason: An unexpected error occurred during logon

Event ID: 538
Type: Success Audit
Description: User Logoff:

Event ID: 539
Type: Failure Audit
Description: Logon Failure:
Reason: Account locked out

Event ID: 560
Type: Success Audit
Description: Object Open

Event ID: 561
Type: Success Audit
Description: Handle Allocated

Event ID: 562
Type: Success Audit
Description: Handle Closed


Event ID: 563
Type: Success Audit
Description: Object Open for Delete

Event ID: 564
Type: Success Audit
Description: Object Deleted

Event ID: 576
Type: Success Audit
Description: Special privileges assigned to new logon

Event ID: 577
Type: Success Audit
Description: Privileged Service Called

Event ID: 578
Type: Failure Audit
Description: Privileged object operation

Event ID: 592
Type: Success Audit
Description: A new process has been created

Event ID: 593
Type: Success Audit
Description: A process has exited

Event ID: 594
Type: Success Audit
Description: A handle to an object has been duplicated

Event ID: 595
Type: Success Audit
Description: Indirect access to an object has been obtained

Event ID: 608
Type: Success Audit
Description: User Right Assigned

Event ID: 609
Type: Success Audit
Description: User Right Removed

Event ID: 610
Type: Success Audit
Description: New Trusted Domain

Event ID: 611
Type: Success Audit
Description: Removing Trusted Domain

Event ID: 612
Type: Success Audit
Description: Audit Policy Change:
New Policy:
Success   Failure
%1         %2    System
%3         %4    Logon/Logoff
%5         %6    Object Access
%7         %8    Privilege Use
%9        %10    Detailed Tracking
%11        %12    Policy Change
%13        %14    Account Management
Changed By:

Event ID: 624
Type: Success Audit
Description: User Account Created

Event ID: 625
Type: Success Audit
Description: User Account Type Change

Event ID: 626
Type: Success Audit
Description: User Account Enabled

Event ID: 627
Type: Success Audit
Description: Change Password Attempt

Event ID: 628
Type: Success Audit
Description: User Account password set

Event ID: 629
Type: Success Audit
Description: User Account Disabled

Event ID: 630
Type: Success Audit
Description: User Account Deleted

Event ID: 631
Type: Success Audit
Description: Global Group Created

Event ID: 632
Type: Success Audit
Description: Global Group Member Added

Event ID: 633
Type: Success Audit
Description: Global Group Member Removed

Event ID: 634
Type: Success Audit
Description: Global Group Deleted

Event ID: 635
Type: Success Audit
Description: Local Group Created

Event ID: 636
Type: Success Audit
Description: Local Group Member Added

Event ID: 637
Type: Success Audit
Description: Local Group Member Removed

Event ID: 638
Type: Success Audit
Description: Local Group Deleted

Event ID: 639
Type: Success Audit
Description: Local Group Changed

Event ID: 640
Type: Success Audit
Description: General Account Database Change

Event ID: 641
Type: Success Audit
Description: Global Group Changed

Event ID: 642
Type: Success Audit
Description: User Account Changed


Event ID: 643
Type: Success Audit
Description: Domain Policy Changed

Event ID: 644
Event Type: Success Audit
Description: User Account Locked Out

Hiç yorum yok:

Yorum Gönder