Windows Server 2008 Security Events Summary

Listed below you will find a summary grid of the new Windows Server 2008 (and Vista) Security Events. With the release of Server 2008, Microsoft expanded the Audit Policies to 52 (in Windows Server 2003 there were nine). The structure of the event logs was also totally revamped and changed in Sever 2008 and Vista.

With 52 Audit Categories administrators now have better controls over the type of auditing they can enable on their systems. However lack of Group Policy integration requires the more cubersome use of Audit Policy which may cause conflicts in some organizations.

We hope that you find this information useful in your research and deployment efforts with Windows Server 2008.

Event ID	Category	Subcategory	Message Summary
4774	Account Logon	Credential Validation	An account was mapped for logon.
4775	Account Logon	Credential Validation	An account could not be mapped for logon.
4776	Account Logon	Credential Validation	The domain controller attempted to validate the credentials for an account.
4777	Account Logon	Credential Validation	The domain controller failed to validate the credentials for an account.

4768	Account Logon	Kerberos Authentication Service	A Kerberos authentication ticket (TGT) was requested.
4771	Account Logon	Kerberos Authentication Service	Kerberos pre-authentication failed.
4772	Account Logon	Kerberos Authentication Service	A Kerberos authentication ticket request failed.

4769	Account Logon	Kerberos Service Ticket Operations	A Kerberos service ticket was requested.
4770	Account Logon	Kerberos Service Ticket Operations	A Kerberos service ticket was renewed.
Back to top
Event ID	Category	Subcategory	Message Summary
4783	Account Management	Application Group Management	A basic application group was created.
4784	Account Management	Application Group Management	A basic application group was changed.
4785	Account Management	Application Group Management	A member was added to a basic application group.
4786	Account Management	Application Group Management	A member was removed from a basic application group.
4787	Account Management	Application Group Management	A non-member was added to a basic application group.
4788	Account Management	Application Group Management	A non-member was removed from a basic application group.
4789	Account Management	Application Group Management	A basic application group was deleted.
4790	Account Management	Application Group Management	An LDAP query group was created.

4741	Account Management	Computer Account Management	A computer account was created.
4742	Account Management	Computer Account Management	A computer account was changed.
4743	Account Management	Computer Account Management	A computer account was deleted.

4744	Account Management	Distribution Group Management	A security-disabled local group was created.
4745	Account Management	Distribution Group Management	A security-disabled local group was changed.
4746	Account Management	Distribution Group Management	A member was added to a security-disabled local group.
4747	Account Management	Distribution Group Management	A member was removed from a security-disabled local group.
4748	Account Management	Distribution Group Management	A security-disabled local group was deleted.
4749	Account Management	Distribution Group Management	A security-disabled global group was created.
4750	Account Management	Distribution Group Management	A security-disabled global group was changed.
4751	Account Management	Distribution Group Management	A member was added to a security-disabled global group.
4752	Account Management	Distribution Group Management	A member was removed from a security-disabled global group.
4753	Account Management	Distribution Group Management	A security-disabled global group was deleted.
4759	Account Management	Distribution Group Management	A security-disabled universal group was created.
4760	Account Management	Distribution Group Management	A security-disabled universal group was changed.
4761	Account Management	Distribution Group Management	A member was added to a security-disabled universal group.
4762	Account Management	Distribution Group Management	A member was removed from a security-disabled universal group.

4782	Account Management	Other Account Management Events	The password hash an account was accessed.
4793	Account Management	Other Account Management Events	The Password Policy Checking API was called.

4727	Account Management	Security Group Management	A security-enabled global group was created.
4728	Account Management	Security Group Management	A member was added to a security-enabled global group.
4729	Account Management	Security Group Management	A member was removed from a security-enabled global group.
4730	Account Management	Security Group Management	A security-enabled global group was deleted.
4731	Account Management	Security Group Management	A security-enabled local group was created.
4732	Account Management	Security Group Management	A member was added to a security-enabled local group.
4733	Account Management	Security Group Management	A member was removed from a security-enabled local group.
4734	Account Management	Security Group Management	A security-enabled local group was deleted.
4735	Account Management	Security Group Management	A security-enabled local group was changed.
4737	Account Management	Security Group Management	A security-enabled global group was changed.
4754	Account Management	Security Group Management	A security-enabled universal group was created.
4755	Account Management	Security Group Management	A security-enabled universal group was changed.
4756	Account Management	Security Group Management	A member was added to a security-enabled universal group.
4757	Account Management	Security Group Management	A member was removed from a security-enabled universal group.
4758	Account Management	Security Group Management	A security-enabled universal group was deleted.
4764	Account Management	Security Group Management	A group's type was changed.

4720	Account Management	User Account Management	A user account was created.
4722	Account Management	User Account Management	A user account was enabled.
4723	Account Management	User Account Management	An attempt was made to change an account's password.
4724	Account Management	User Account Management	An attempt was made to reset an account's password.
4725	Account Management	User Account Management	A user account was disabled.
4726	Account Management	User Account Management	A user account was deleted.
4738	Account Management	User Account Management	A user account was changed.
4740	Account Management	User Account Management	A user account was locked out.
4765	Account Management	User Account Management	SID History was added to an account.
4766	Account Management	User Account Management	An attempt to add SID History to an account failed.
4767	Account Management	User Account Management	A user account was unlocked.
4780	Account Management	User Account Management	The ACL was set on accounts which are members of administrators groups.
4781	Account Management	User Account Management	The name of an account was changed:
4794	Account Management	User Account Management	An attempt was made to set the Directory Services Restore Mode.
5376	Account Management	User Account Management	Credential Manager credentials were backed up.
5377	Account Management	User Account Management	Credential Manager credentials were restored from a backup.
Back to top
Event ID	Category	Subcategory	Message Summary
4692	Detailed Tracking	DPAPI Activity	Backup of data protection master key was attempted.
4693	Detailed Tracking	DPAPI Activity	Recovery of data protection master key was attempted.
4694	Detailed Tracking	DPAPI Activity	Protection of auditable protected data was attempted.
4695	Detailed Tracking	DPAPI Activity	Unprotection of auditable protected data was attempted.

4688	Detailed Tracking	Process Creation	A new process has been created.
4696	Detailed Tracking	Process Creation	A primary token was assigned to process.

4689	Detailed Tracking	Process Termination	A process has exited.

5712	Detailed Tracking	RPC Events	A Remote Procedure Call (RPC) was attempted.
Back to top
Event ID	Category	Subcategory	Message Summary
4928	DS Access	Detailed Directory Service Replication	An Active Directory replica source naming context was established.
4929	DS Access	Detailed Directory Service Replication	An Active Directory replica source naming context was removed.
4930	DS Access	Detailed Directory Service Replication	An Active Directory replica source naming context was modified.
4931	DS Access	Detailed Directory Service Replication	An Active Directory replica destination naming context was modified.
4934	DS Access	Detailed Directory Service Replication	Attributes of an Active Directory object were replicated.
4935	DS Access	Detailed Directory Service Replication	Replication failure begins.
4936	DS Access	Detailed Directory Service Replication	Replication failure ends.
4937	DS Access	Detailed Directory Service Replication	A lingering object was removed from a replica.

4662	DS Access	Directory Service Access	An operation was performed on an object.

5136	DS Access	Directory Service Changes	A directory service object was modified.
5137	DS Access	Directory Service Changes	A directory service object was created.
5138	DS Access	Directory Service Changes	A directory service object was undeleted.
5139	DS Access	Directory Service Changes	A directory service object was moved.
5141	DS Access	Directory Service Changes	A directory service object was deleted.

4932	DS Access	Directory Service Replication	Synchronization of a replica of an Active Directory naming context has begun.
4933	DS Access	Directory Service Replication	Synchronization of a replica of an Active Directory naming context has ended.
Back to top
Event ID	Category	Subcategory	Message Summary
4625	Logon/Logoff	Account Lockout	An account failed to logon

4978	Logon/Logoff	IPsec Extended Mode	During Extended Mode negotiation, IPsec received an invalid negotiation packet. If this problem persists, it could indicate a network issue or an attempt to modify or replay this negotiation.
4979	Logon/Logoff	IPsec Extended Mode	IPsec Main Mode and Extended Mode security associations were established.
4980	Logon/Logoff	IPsec Extended Mode	IPsec Main Mode and Extended Mode security associations were established.
4981	Logon/Logoff	IPsec Extended Mode	IPsec Main Mode and Extended Mode security associations were established.
4982	Logon/Logoff	IPsec Extended Mode	IPsec Main Mode and Extended Mode security associations were established.
4983	Logon/Logoff	IPsec Extended Mode	An IPsec Extended Mode negotiation failed. The corresponding Main Mode security association has been deleted.
4984	Logon/Logoff	IPsec Extended Mode	An IPsec Extended Mode negotiation failed. The corresponding Main Mode security association has been deleted.

4646	Logon/Logoff	IPsec Main Mode	IKE DoS-prevention mode started.
4650	Logon/Logoff	IPsec Main Mode	An IPsec Main Mode security association was established. Extended Mode was not enabled. Certificate authentication was not used.
4651	Logon/Logoff	IPsec Main Mode	An IPsec Main Mode security association was established. Extended Mode was not enabled. A certificate was used for authentication.
4652	Logon/Logoff	IPsec Main Mode	An IPsec Main Mode negotiation failed.
4653	Logon/Logoff	IPsec Main Mode	An IPsec Main Mode negotiation failed.
4655	Logon/Logoff	IPsec Main Mode	An IPsec Main Mode security association ended.
4976	Logon/Logoff	IPsec Main Mode	During Main Mode negotiation, IPsec received an invalid negotiation packet. If this problem persists, it could indicate a network issue or an attempt to modify or replay this negotiation.
5049	Logon/Logoff	IPsec Main Mode	An IPsec Security Association was deleted.
5453	Logon/Logoff	IPsec Main Mode	An IPsec negotiation with a remote computer failed because the IKE and AuthIP IPsec Keying Modules (IKEEXT) service is not started.

4654	Logon/Logoff	IPsec Quick Mode	An IPsec Quick Mode negotiation failed.
4977	Logon/Logoff	IPsec Quick Mode	During Quick Mode negotiation, IPsec received an invalid negotiation packet. If this problem persists, it could indicate a network issue or an attempt to modify or replay this negotiation.
5451	Logon/Logoff	IPsec Quick Mode	An IPsec Quick Mode security association was established.
5452	Logon/Logoff	IPsec Quick Mode	An IPsec Quick Mode security association ended.

4634	Logon/Logoff	Logoff	An account was logged off.
4647	Logon/Logoff	Logoff	User initiated logoff.

4624	Logon/Logoff	Logon	An account was successfully logged on.
4625	Logon/Logoff	Logon	An account failed to log on.
4648	Logon/Logoff	Logon	A logon was attempted using explicit credentials.
4675	Logon/Logoff	Logon	SIDs were filtered.

6272	Logon/Logoff	Network Policy Server	Network Policy Server granted access to a user.
6273	Logon/Logoff	Network Policy Server	Network Policy Server denied access to a user.
6274	Logon/Logoff	Network Policy Server	Network Policy Server discarded the request for a user.
6275	Logon/Logoff	Network Policy Server	Network Policy Server discarded the accounting request for a user.
6276	Logon/Logoff	Network Policy Server	Network Policy Server quarantined a user.
6277	Logon/Logoff	Network Policy Server	Network Policy Server granted access to a user but put it on probation because the host did not meet the defined health policy.
6278	Logon/Logoff	Network Policy Server	Network Policy Server granted full access to a user because the host met the defined health policy.
6279	Logon/Logoff	Network Policy Server	Network Policy Server locked the user account due to repeated failed authentication attempts.
6280	Logon/Logoff	Network Policy Server	Network Policy Server unlocked the user account.

4649	Logon/Logoff	Other Logon/Logoff Events	A replay attack was detected.
4778	Logon/Logoff	Other Logon/Logoff Events	A session was reconnected to a Window Station.
4779	Logon/Logoff	Other Logon/Logoff Events	A session was disconnected from a Window Station.
4800	Logon/Logoff	Other Logon/Logoff Events	The workstation was locked.
4801	Logon/Logoff	Other Logon/Logoff Events	The workstation was unlocked.
4802	Logon/Logoff	Other Logon/Logoff Events	The screen saver was invoked.
4803	Logon/Logoff	Other Logon/Logoff Events	The screen saver was dismissed.
5378	Logon/Logoff	Other Logon/Logoff Events	The requested credentials delegation was disallowed by policy.
5632	Logon/Logoff	Other Logon/Logoff Events	A request was made to authenticate to a wireless network.
5633	Logon/Logoff	Other Logon/Logoff Events	A request was made to authenticate to a wired network.

4964	Logon/Logoff	Special Logon	Special groups have been assigned to a new logon.
Back to top
Event ID	Category	Subcategory	Message Summary
4665	Object Access	Application Generated	An attempt was made to create an application client context.
4666	Object Access	Application Generated	An application attempted an operation:
4667	Object Access	Application Generated	An application client context was deleted.
4668	Object Access	Application Generated	An application was initialized.

4868	Object Access	Certification Services	The certificate manager denied a pending certificate request.
4869	Object Access	Certification Services	Certificate Services received a resubmitted certificate request.
4870	Object Access	Certification Services	Certificate Services revoked a certificate.
4871	Object Access	Certification Services	Certificate Services received a request to publish the certificate revocation list (CRL).
4872	Object Access	Certification Services	Certificate Services published the certificate revocation list (CRL).
4873	Object Access	Certification Services	A certificate request extension changed.
4874	Object Access	Certification Services	One or more certificate request attributes changed.
4875	Object Access	Certification Services	Certificate Services received a request to shut down.
4876	Object Access	Certification Services	Certificate Services backup started.
4877	Object Access	Certification Services	Certificate Services backup completed.
4878	Object Access	Certification Services	Certificate Services restore started.
4879	Object Access	Certification Services	Certificate Services restore completed.
4880	Object Access	Certification Services	Certificate Services started.
4881	Object Access	Certification Services	Certificate Services stopped.
4882	Object Access	Certification Services	The security permissions for Certificate Services changed.
4883	Object Access	Certification Services	Certificate Services retrieved an archived key.
4884	Object Access	Certification Services	Certificate Services imported a certificate into its database.
4885	Object Access	Certification Services	The audit filter for Certificate Services changed.
4886	Object Access	Certification Services	Certificate Services received a certificate request.
4887	Object Access	Certification Services	Certificate Services approved a certificate request and issued a certificate.
4888	Object Access	Certification Services	Certificate Services denied a certificate request.
4889	Object Access	Certification Services	Certificate Services set the status of a certificate request to pending.
4890	Object Access	Certification Services	The certificate manager settings for Certificate Services changed.
4891	Object Access	Certification Services	A configuration entry changed in Certificate Services.
4892	Object Access	Certification Services	A property of Certificate Services changed.
4893	Object Access	Certification Services	Certificate Services archived a key.
4894	Object Access	Certification Services	Certificate Services imported and archived a key.
4895	Object Access	Certification Services	Certificate Services published the CA certificate to Active Directory Domain Services.
4896	Object Access	Certification Services	One or more rows have been deleted from the certificate database.
4897	Object Access	Certification Services	Role separation enabled:
4898	Object Access	Certification Services	Certificate Services loaded a template.

5140	Object Access	File Share	A network share object was accessed.

4664	Object Access	File System	An attempt was made to create a hard link.
4985	Object Access	File System	The state of a transaction has changed.
5051	Object Access	File System	A file was virtualized.

5031	Object Access	Filtering Platform Connection	The Windows Firewall Service blocked an application from accepting incoming connections on the network.
5154	Object Access	Filtering Platform Connection	The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.
5155	Object Access	Filtering Platform Connection	The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.
5156	Object Access	Filtering Platform Connection	The Windows Filtering Platform has allowed a connection.
5157	Object Access	Filtering Platform Connection	The Windows Filtering Platform has blocked a connection.
5158	Object Access	Filtering Platform Connection	The Windows Filtering Platform has permitted a bind to a local port.
5159	Object Access	Filtering Platform Connection	The Windows Filtering Platform has blocked a bind to a local port.
5152	Object Access	Filtering Platform Packet Drop	The Windows Filtering Platform blocked a packet.
5153	Object Access	Filtering Platform Packet Drop	A more restrictive Windows Filtering Platform filter has blocked a packet.

4656	Object Access	Handle Manipulation	A handle to an object was requested.
4658	Object Access	Handle Manipulation	The handle to an object was closed.
4690	Object Access	Handle Manipulation	An attempt was made to duplicate a handle to an object.

4671	Object Access	Other Object Access Events	An application attempted to access a blocked ordinal through the TBS.
4691	Object Access	Other Object Access Events	Indirect access to an object was requested.
4698	Object Access	Other Object Access Events	A scheduled task was created.
4699	Object Access	Other Object Access Events	A scheduled task was deleted.
4700	Object Access	Other Object Access Events	A scheduled task was enabled.
4701	Object Access	Other Object Access Events	A scheduled task was disabled.
4702	Object Access	Other Object Access Events	A scheduled task was updated.
5888	Object Access	Other Object Access Events	An object in the COM+ Catalog was modified.
5889	Object Access	Other Object Access Events	An object was deleted from the COM+ Catalog.
5890	Object Access	Other Object Access Events	An object was added to the COM+ Catalog.

4657	Object Access	Registry	A registry value was modified.
5039	Object Access	Registry	A registry key was virtualized.

4659	Object Access	Special	A handle to an object was requested with intent to delete.
4660	Object Access	Special	An object was deleted.
4661	Object Access	Special	A handle to an object was requested.
4663	Object Access	Special	An attempt was made to access an object.
Back to top
Event ID	Category	Subcategory	Message Summary
4715	Policy Change	Audit Policy Change	The audit policy (SACL) on an object was changed.
4719	Policy Change	Audit Policy Change	System audit policy was changed.
4902	Policy Change	Audit Policy Change	The Per-user audit policy table was created.
4904	Policy Change	Audit Policy Change	An attempt was made to register a security event source.
4905	Policy Change	Audit Policy Change	An attempt was made to unregister a security event source.
4906	Policy Change	Audit Policy Change	The CrashOnAuditFail value has changed.
4907	Policy Change	Audit Policy Change	Auditing settings on object were changed.
4908	Policy Change	Audit Policy Change	Special Groups Logon table modified.
4912	Policy Change	Audit Policy Change	Per User Audit Policy was changed.

4713	Policy Change	Authentication Policy Change	Kerberos policy was changed.
4716	Policy Change	Authentication Policy Change	Trusted domain information was modified.
4717	Policy Change	Authentication Policy Change	System security access was granted to an account.
4718	Policy Change	Authentication Policy Change	System security access was removed from an account.
4739	Policy Change	Authentication Policy Change	Domain Policy was changed.
4864	Policy Change	Authentication Policy Change	A namespace collision was detected.
4865	Policy Change	Authentication Policy Change	A trusted forest information entry was added.
4866	Policy Change	Authentication Policy Change	A trusted forest information entry was removed.
4867	Policy Change	Authentication Policy Change	A trusted forest information entry was modified.
4704	Policy Change	Authorization Policy Change	A user right was assigned.
4705	Policy Change	Authorization Policy Change	A user right was removed.
4706	Policy Change	Authorization Policy Change	A new trust was created to a domain.
4707	Policy Change	Authorization Policy Change	A trust to a domain was removed.
4714	Policy Change	Authorization Policy Change	Encrypted data recovery policy was changed.

4709	Policy Change	Filtering Platform Policy Change	IPsec Services was started.
4710	Policy Change	Filtering Platform Policy Change	IPsec Services was disabled.
4711	Policy Change	Filtering Platform Policy Change	May contain any one of the following: PAStore Engine applied locally cached copy of Active Directory storage IPsec policy on the computer. PAStore Engine applied Active Directory storage IPsec policy on the computer. PAStore Engine applied local registry storage IPsec policy on the computer. PAStore Engine failed to apply locally cached copy of Active Directory storage IPsec policy on the computer. PAStore Engine failed to apply Active Directory storage IPsec policy on the computer. PAStore Engine failed to apply local registry storage IPsec policy on the computer. PAStore Engine failed to apply some rules of the active IPsec policy on the computer. PAStore Engine failed to load directory storage IPsec policy on the computer. PAStore Engine loaded directory storage IPsec policy on the computer. PAStore Engine failed to load local storage IPsec policy on the computer. PAStore Engine loaded local storage IPsec policy on the computer. PAStore Engine polled for changes to the active IPsec policy and detected no changes.
4712	Policy Change	Filtering Platform Policy Change	IPsec Services encountered a potentially serious failure.
5040	Policy Change	Filtering Platform Policy Change	A change has been made to IPsec settings. An Authentication Set was added.
5041	Policy Change	Filtering Platform Policy Change	A change has been made to IPsec settings. An Authentication Set was modified.
5042	Policy Change	Filtering Platform Policy Change	A change has been made to IPsec settings. An Authentication Set was deleted.
5043	Policy Change	Filtering Platform Policy Change	A change has been made to IPsec settings. A Connection Security Rule was added.
5044	Policy Change	Filtering Platform Policy Change	A change has been made to IPsec settings. A Connection Security Rule was modified.
5045	Policy Change	Filtering Platform Policy Change	A change has been made to IPsec settings. A Connection Security Rule was deleted.
5046	Policy Change	Filtering Platform Policy Change	A change has been made to IPsec settings. A Crypto Set was added.
5047	Policy Change	Filtering Platform Policy Change	A change has been made to IPsec settings. A Crypto Set was modified.
5048	Policy Change	Filtering Platform Policy Change	A change has been made to IPsec settings. A Crypto Set was deleted.
5440	Policy Change	Filtering Platform Policy Change	The following callout was present when the Windows Filtering Platform Base Filtering Engine started.
5441	Policy Change	Filtering Platform Policy Change	The following filter was present when the Windows Filtering Platform Base Filtering Engine started.
5442	Policy Change	Filtering Platform Policy Change	The following provider was present when the Windows Filtering Platform Base Filtering Engine started.
5443	Policy Change	Filtering Platform Policy Change	The following provider context was present when the Windows Filtering Platform Base Filtering Engine started.
5444	Policy Change	Filtering Platform Policy Change	The following sub-layer was present when the Windows Filtering Platform Base Filtering Engine started.
5446	Policy Change	Filtering Platform Policy Change	A Windows Filtering Platform callout has been changed.
5448	Policy Change	Filtering Platform Policy Change	A Windows Filtering Platform provider has been changed.
5449	Policy Change	Filtering Platform Policy Change	A Windows Filtering Platform provider context has been changed.
5450	Policy Change	Filtering Platform Policy Change	A Windows Filtering Platform sub-layer has been changed.
5456	Policy Change	Filtering Platform Policy Change	PAStore Engine applied Active Directory storage IPsec policy on the computer.
5457	Policy Change	Filtering Platform Policy Change	PAStore Engine failed to apply Active Directory storage I