| ID | Event Description |
|---|
| 4720 | A user account was created
ISO 27001:2013, NIST SP 800-53, Audit Success, PCI-DSS, NIST 800-171, CMMC L1 |
| 4722 | A user account was enabled
ISO 27001:2013, NIST SP 800-53, NIST 800-171, Audit Success, PCI-DSS, CMMC L1 |
| 4723 | An attempt was made to change an account's password
Audit Success, Audit Failure, CJIS |
| 4724 | An attempt was made to reset an account's password
Audit Failure, Audit Success, CJIS, ISO 27001:2013 |
| 4725 | A user account was disabled
ISO 27001:2013, NIST 800-171, NIST SP 800-53, Audit Success, PCI-DSS, CMMC L1 |
| 4726 | A user account was deleted
ISO 27001:2013, NIST 800-171, NIST SP 800-53, Audit Success, PCI-DSS, CMMC L1 |
| 4727 | A security-enabled global group was created
Domain Controller |
| 4728 | A member was added to a security-enabled global group
Domain Controller, ISO 27001:2013, NIST 800-171, NIST SP 800-53, CMMC L1 |
| 4729 | A member was removed from a security-enabled global group
Domain Controller |
| 4730 | A security-enabled global group was deleted
Domain Controller |
| 4731 | A security-enabled local group was created
Audit Success |
| 4732 | A member was added to a security-enabled local group
ISO 27001:2013, NIST 800-171, NIST SP 800-53, Audit Success, CMMC L1 |
| 4733 | A member was removed from a security-enabled local group
Audit Success |
| 4734 | A security-enabled local group was deleted
Audit Success |
| 4735 | A security-enabled local group was changed
Audit Success |
| 4737 | A security-enabled global group was changed
Domain Controller |
| 4738 | A user account was changed
ISO 27001:2013, NIST 800-171, NIST SP 800-53, Audit Success, CMMC L1 |
| 4740 | A user account was locked out
ISO 27001:2013, NIST 800-171, NIST SP 800-53, Audit Success, CMMC L3 |
| 4741 | A computer account was created
Domain Controller, Audit Success |
| 4742 | A computer account was changed
Domain Controller, Audit Success |
| 4743 | A computer account was deleted
Domain Controller, Audit Success |
| 4744 | A security-disabled local group was created
|
| 4745 | A security-disabled local group was changed
|
| 4746 | A member was added to a security-disabled local group
|
| 4747 | A member was removed from a security-disabled local group
|
| 4748 | A security-disabled local group was deleted
|
| 4749 | A security-disabled global group was created
Domain Controller, Audit Success |
| 4750 | A security-disabled global group was changed
Domain Controller, Audit Success |
| 4751 | A member was added to a security-disabled global group
Domain Controller, Audit Success |
| 4752 | A member was removed from a security-disabled global group
Domain Controller, Audit Success |
| 4753 | A security-disabled global group was deleted
Domain Controller, Audit Success |
| 4754 | A security-enabled universal group was created
Domain Controller |
| 4755 | A security-enabled universal group was changed
Domain Controller |
| 4756 | A member was added to a security-enabled universal group
Domain Controller, ISO 27001:2013 |
| 4757 | A member was removed from a security-enabled universal group
Domain Controller |
| 4758 | A security-enabled universal group was deleted
Domain Controller |
| 4759 | A security-disabled universal group was created
Domain Controller |
| 4760 | A security-disabled universal group was changed
Domain Controller |
| 4761 | A member was added to a security-disabled universal group
Domain Controller |
| 4762 | A member was removed from a security-disabled universal group
Domain Controller |
| 4763 | A security-disabled universal group was deleted
Domain Controller |
| 4764 | A group’s type was changed
Domain Controller, Audit Success |
| 4765 | SID History was added to an account
Domain Controller, Audit Success |
| 4766 | An attempt to add SID History to an account failed
Domain Controller, Audit Failure |
| 4767 | A user account was unlocked
ISO 27001:2013, Audit Success |
| 4780 | The ACL was set on accounts which are members of administrators groups
Domain Controller, Audit Success |
| 4781 | The name of an account was changed
Audit Success |
| 4782 | The password hash of an account was accessed
Domain Controller, Audit Success |
| 4783 | A basic application group was created
Domain Controller, Audit Success |
| 4784 | A basic application group was changed
Domain Controller, Audit Success |
| 4785 | A member was added to a basic application group
Domain Controller, Audit Success |
| 4786 | A member was removed from a basic application group
Domain Controller, Audit Success |
| 4787 | A non-member was added to a basic application group
Domain Controller, Audit Success |
| 4788 | A non-member was removed from a basic application group
Domain Controller, Audit Success |
| 4789 | A basic application group was deleted
Domain Controller, Audit Success |
| 4790 | An LDAP query group was created
Domain Controller, Audit Success |
| 4791 | A basic application group was changed
Domain Controller, Audit Success |
| 4792 | An LDAP query group was deleted
Domain Controller, Audit Success |
| 4793 | The Password Policy Checking API was called
Domain Controller, Audit Success |
| 4794 | An attempt was made to set the Directory Services Restore Mode administrator password
Domain Controller, Audit Success, Audit Failure |
| 4797 | An attempt was made to query the existence of a blank password for an account
|
| 4798 | A user's local group membership was enumerated
Audit Success |
| 4799 | A security-enabled local group membership was enumerated
Audit Success |
| 5376 | Credential Manager credentials were backed up.
Audit Success |
| 5377 | Credential Manager credentials were restored from a backup.
Audit Success |
| 5378 | The requested credentials delegation was disallowed by policy.
Audit Failure |
| 5379 | Records instances where Credential Manager credentials were read
|
| 624 | User Account Created
|
| 626 | User Account Enabled
|
| 627 | Change Password Attempt
|
| 628 | User Account password set
|
| 629 | User Account Disabled
|
| 630 | User Account Deleted
|
| 631 | Security Enabled Global Group Created
|
| 632 | Security Enabled Global Group Member Added
|
| 633 | Security Enabled Global Group Member Removed
|
| 634 | Security Enabled Global Group Deleted
|
| 635 | Security Enabled Local Group Created
|
| 636 | Security Enabled Local Group Member Added
|
| 637 | Security Enabled Local Group Member Removed
|
| 638 | Security Enabled Local Group Deleted
|
| 639 | Security Enabled Local Group Changed
|
| 640 | General Account Database Change
|
| 641 | Security Enabled Global Group Changed
|
| 642 | User Account Changed
|
| 643 | Domain Policy Changed
|
| 644 | User Account Locked Out
|
| 645 | Computer Account Created
|
| 646 | Computer Account Changed
|
| 647 | Computer Account Deleted
|
| 648 | Security Disabled Local Group Created
|
| 649 | Security Disabled Local Group Changed
|
| 650 | Security Disabled Local Group Member Added
|
| 651 | Security Disabled Local Group Member Removed
|
| 652 | Security Disabled Local Group Deleted
|
| 653 | Security Disabled Global Group Created
|
| 654 | Security Disabled Global Group Changed
|
| 655 | Security Disabled Global Group Member Added
|
| 656 | Security Disabled Global Group Member Removed
|
| 657 | Security Disabled Global Group Deleted
|
| 658 | Security Enabled Universal Group Created
|
| 659 | Security Enabled Universal Group Changed
|
| 660 | Security Enabled Universal Group Member Added
|
| 661 | Security Enabled Universal Group Member Removed
|
| 662 | Security Enabled Universal Group Deleted
|
| 663 | Security Disabled Universal Group Created
|
| 664 | Security Disabled Universal Group Changed
|
| 665 | Security Disabled Universal Group Member Added
|
| 666 | Security Disabled Universal Group Member Removed
|
| 667 | Security Disabled Universal Group Deleted
|
| 668 | Group Type Changed
|
| 669 | Add SID History
|
| 670 | Add SID History
|
| 671 | User Account Unlocked
|
| 684 | Set ACLs of members in administrators groups
|
| 685 | Account Name Changed
|
| 686 | Password of the following user accessed
|
| 687 | Basic Application Group Created
|
| 688 | Basic Application Group Changed
|
| 689 | Basic Application Group Member Added
|
| 690 | Basic Application Group Member Removed
|
| 691 | Basic Application Group Non-Member Added
|
| 692 | Basic Application Group Non-Member Removed
|
| 693 | Basic Application Group Deleted
|
| 694 | LDAP Query Group Created
|
| 695 | LDAP Query Group Changed
|
| 696 | LDAP Query Group Deleted
|
| 697 | Password Policy Checking API is called
|
| 698 | An attempt to set the Directory Services Restore Mode administrator password has been made
|
| 699 | RODC SpecifiC Local Group Member Added
|