# Appendix B. Security Event ID description table

Event ID = Description ``

    0 = Unused message ID
    1 = System Event
    2 = Logon/Logoff
    3 = Object Access
    4 = Privilege Use
    5 = Detailed Tracking
    6 = Policy Change
    7 = Account Management
    8 = Directory Service Access
    9 = Account Logon
    512 = Windows NT is starting up.
    513 = Windows NT is shutting down.
    514 = An authentication package has been loaded by the Local Security Authority.
    515 = A trusted logon process has registered with the Local Security Authority.
    516 = Internal resources allocated for the queuing of audit messages have been exhausted
    517 = The audit log was cleared
    518 = An notification package has been loaded by the Security Account Manager.
    528 = Successful Logon
    529 = Logon Failure: Unknown user name or bad password
    530 = Logon Failure: Account logon time restriction violation
    531 = Logon Failure: Account currently disabled
    532 = Logon Failure: The specified user account has expired
    533 = Logon Failure: User not allowed to logon at this computer
    534 = Logon Failure: The user has not been granted the requested logon type at this machine
    535 = The specified account\'s password has expired
    536 = Logon Failure: The NetLogon component is not active
    537 = Logon Failure: An unexpected error occurred during logon
    538 = User Logoff
    539 = Logon Failure:
    540 = Successful Network Logon
    541 = IKE security association established.
    542 = IKE security association ended : Data Protection
    543 = IKE security association ended : Key Exchange544' = IKE security association establishment failed because peer could not authenticate : The certificate trust coud not be established.
    545 = IKE peer authentication failed
    546 = IKE security association establishment failed because peer sent invalid proposal.
    547 = IKE security association negotiation failed.
    560 = Object Open
    561 = Handle Allocated
    562 = Handle Closed
    563 = Object Open for Delete
    564 = Object Deleted
    565 = Object Open
    566 = Object Operation
    576 = Special privileges assigned to new logon
    577 = Privileged Service Called
    578 = Privileged object operation
    592 = A new process has been created
    593 = A process has exited
    594 = A handle to an object has been duplicated
    595 = Indirect access to an object has been obtained
    608 = User Right Assigned
    609 = User Right Removed
    610 = New Trusted Domain
    611 = Removing Trusted Domain
    612 = Audit Policy Change
    613 = IPSec policy agent started
    614 = IPSec policy agent disabled
    615 = IPSec PolicyAgent Service
    616 = IPSec policy agent encountered a potentially serious failure.
    617 = Kerberos Policy Changed
    618 = Encrypted Data Recovery policy Changed
    619 = Quality of Service Policy Changed
    620 = Trusted Domain Information Modified
    624 = User Account Created
    625 = User Account Type Change
    626 = User Account Enabled
    627 = Change Password Attempt
    628 = User Account password set
    629 = User Account Disabled
    630 = User Account Deleted
    631 = Security Enabled Global Group Created
    632 = Security Enabled Global Group Member Added
    633 = Security Enabled Global Group Member Removed
    634 = Security Enabled Global Group Deleted
    635 = Security Enabled Local Group Created
    636 = Security Enabled Local Group Member Added
    637 = Security Enabled Local Group Member Removed
    638 = Security Enabled Local Group Deleted
    639 = Security Enabled Local Group Changed
    640 = General Account Database Change
    641 = Security Enabled Global Group Changed
    642 = User Account Changed
    643 = Domain Policy Changed
    644 = User Account Locked Out
    645 = Computer Account Created
    646 = Computer Account Changed
    647 = Computer Account Deleted
    648 = Security Disabled Local Group Created
    649 = Security Disabled Local Group Changed
    650 = Security Disabled Local Group Member Added
    651 = Security Disabled Local Group Member Removed
    652 = Security Disabled Local Group Deleted
    653 = Security Disabled Global Group Created
    654 = Security Disabled Global Group Changed
    655 = Security Disabled Global Group Member Added
    656 = Security Disabled Global Group Member Removed
    657 = Security Disabled Global Group Deleted
    658 = Security Enabled Universal Group Created
    659 = Security Enabled Universal Group Changed
    660 = Security Enabled Universal Group Member Added
    661 = Security Enabled Universal Group Member Removed
    662 = Security Enabled Universal Group Deleted
    663 = Security Disabled Universal Group Created
    664 = Security Disabled Universal Group Changed
    665 = Security Disabled Universal Group Member Added
    666 = Security Disabled Universal Group Member Removed
    667 = Security Disabled Universal Group Deleted
    668 = Group Type Changed
    669 = Add SID History
    670 = Add SID History
    672 = Authentication Ticket Granted
    673 = Service Ticket Granted
    674 = Ticket Granted Renewed
    675 = Pre - authentication failed
    676 = Authentication Ticket Request Failed
    677 = Service Ticket Request Failed
    678 = Account Mapped for Logon
    679 = Account Mapping for Logon failure
    680 = Account Used for Logon
    681 = Logon to account failure
    682 = Session reconnected to winstation
    683 = Session disconnected from winstation

Appendix A. Resources
Appendix C. filter.txt used in Chapter 10