Windows Security Events


Audit Category
Operating Systems
Tags
Auditing
Volume
Audit Subcategory
AppLocker
EventSentry
Security
Sysmon
ID Event Description
4660 An object was deleted
Audit Success
4661 A handle to an object was requested
Domain Controller, Audit Success, Audit Failure
4690 An attempt was made to duplicate a handle to an object
Audit Success
4769 A Kerberos service ticket was requested
Domain Controller, Audit Success, Audit Failure, CJIS, ISO 27001:2013, HIPAA, NIST 800-171, NIST SP 800-53, CMMC L1
4770 A Kerberos service ticket was renewed
Domain Controller, Audit Success
4802 The screen saver was invoked
ISO 27001:2013, Audit Success, NIST 800-171, NIST SP 800-53, CMMC L3
4803 The screen saver was dismissed
ISO 27001:2013, Audit Success, NIST 800-171, NIST SP 800-53, CMMC L3
4818 Proposed Central Access Policy does not grant the same access permissions as the current Central Access Policy
Audit Success
5152 The Windows Filtering Platform has blocked a packet.
Audit Failure
5153 A more restrictive Windows Filtering Platform filter has blocked a packet.
Audit Success
5156 The Windows Filtering Platform has allowed a connection.
Audit Success
5157 The Windows Filtering Platform has blocked a connection.
Audit Failure
5158 The Windows Filtering Platform has permitted a bind to a local port.
Audit Success
5440 The following callout was present when the Windows Filtering Platform Base Filtering Engine started.
5441 The following filter was present when the Windows Filtering Platform Base Filtering Engine started.
5442 The following provider was present when the Windows Filtering Platform Base Filtering Engine started.
5443 The following provider context was present when the Windows Filtering Platform Base Filtering Engine started.
5444 The following sub-layer was present when the Windows Filtering Platform Base Filtering Engine started.
5447 A Windows Filtering Platform filter has been changed.
Audit Success
5449 A Windows Filtering Platform provider context has been changed.
5451 An IPsec quick mode security association was established.
5452 An IPsec quick mode security association ended.
5462 PAStore Engine failed to apply some rules of the active IPsec policy on the computer
5712 A Remote Procedure Call (RPC) was attempted.
Audit Success