| ID | Event Description |
|---|---|
| 4618 |
A monitored security event pattern has occurred.
Audit Success
|
| 4624 |
An account was successfully logged on
CJIS, Audit Success, ISO 27001:2013, HIPAA, NIST SP 800-53, CMMC L1, NIST 800-171
|
| 4625 |
An account failed to log on
Audit Failure, CJIS, ISO 27001:2013, PCI-DSS, HIPAA, NIST SP 800-53, NIST 800-171, CMMC L1
|
| 4626 |
User / Device claims information
Audit Success
|
| 4627 |
Group membership information
Audit Success
|
| 4634 |
An account was logged off
Audit Success
|
| 4647 |
User initiated logoff
Audit Success
|
| 4688 |
A new process has been created
NIST 800-171, NIST SP 800-53, Audit Success, ISO 27001:2013, CMMC L3
|
| 4696 |
A primary token was assigned to process
Audit Success
|
| 4703 |
A token right was adjusted
Audit Success
|
| 4800 |
The workstation was locked
Audit Success, ISO 27001:2013, NIST 800-171, NIST SP 800-53, CMMC L3
|
| 4801 |
The workstation was unlocked
ISO 27001:2013, Audit Success, NIST 800-171, NIST SP 800-53, CMMC L3
|
| 4912 |
Per User Audit Policy was changed
Audit Success
|