| ID | Event Description |
|---|
| 4656 | A handle to an object was requested
Audit Failure, Audit Success, CJIS |
| 4663 | An attempt was made to access an object
Audit Success, CJIS |
| 4675 | SIDs were filtered
Domain Controller, Audit Success |
| 4706 | A new trust was created to a domain
Domain Controller, Audit Success |
| 4716 | Trusted domain information was modified
Domain Controller, Audit Success |
| 4720 | A user account was created
ISO 27001:2013, NIST SP 800-53, Audit Success, PCI-DSS, NIST 800-171, CMMC L1 |
| 4727 | A security-enabled global group was created
Domain Controller |
| 4731 | A security-enabled local group was created
Audit Success |
| 4735 | A security-enabled local group was changed
Audit Success |
| 4737 | A security-enabled global group was changed
Domain Controller |
| 4738 | A user account was changed
ISO 27001:2013, NIST 800-171, NIST SP 800-53, Audit Success, CMMC L1 |
| 4739 | Domain Policy was changed
Domain Controller, NIST 800-171, NIST SP 800-53, ISO 27001:2013, Audit Success, CMMC L3 |
| 4741 | A computer account was created
Domain Controller, Audit Success |
| 4742 | A computer account was changed
Domain Controller, Audit Success |
| 4744 | A security-disabled local group was created
|
| 4745 | A security-disabled local group was changed
|
| 4749 | A security-disabled global group was created
Domain Controller, Audit Success |
| 4750 | A security-disabled global group was changed
Domain Controller, Audit Success |
| 4754 | A security-enabled universal group was created
Domain Controller |
| 4755 | A security-enabled universal group was changed
Domain Controller |
| 4759 | A security-disabled universal group was created
Domain Controller |
| 4760 | A security-disabled universal group was changed
Domain Controller |
| 4783 | A basic application group was created
Domain Controller, Audit Success |
| 4784 | A basic application group was changed
Domain Controller, Audit Success |
| 4790 | An LDAP query group was created
Domain Controller, Audit Success |
| 4791 | A basic application group was changed
Domain Controller, Audit Success |
| 4874 | One or more certificate request attributes changed
|
| 4886 | Certificate Services received a certificate request
|
| 4887 | Certificate Services approved a certificate request and issued a certificate
|
| 4888 | Certificate Services denied a certificate request
|
| 4889 | Certificate Services set the status of a certificate request to pending
|
| 4911 | Resource attributes of the object were changed
Audit Success |
| 4934 | Attributes of an Active Directory object were replicated
Domain Controller, Audit Success, Audit Failure |
| 5712 | A Remote Procedure Call (RPC) was attempted.
Audit Success |
| 610 | New Trusted Domain
|
| 620 | Trusted Domain Information Modified
|
| 624 | User Account Created
|
| 631 | Security Enabled Global Group Created
|
| 635 | Security Enabled Local Group Created
|
| 639 | Security Enabled Local Group Changed
|
| 641 | Security Enabled Global Group Changed
|
| 642 | User Account Changed
|
| 643 | Domain Policy Changed
|
| 645 | Computer Account Created
|
| 646 | Computer Account Changed
|
| 648 | Security Disabled Local Group Created
|
| 649 | Security Disabled Local Group Changed
|
| 653 | Security Disabled Global Group Created
|
| 654 | Security Disabled Global Group Changed
|
| 658 | Security Enabled Universal Group Created
|
| 659 | Security Enabled Universal Group Changed
|
| 663 | Security Disabled Universal Group Created
|
| 664 | Security Disabled Universal Group Changed
|
| 687 | Basic Application Group Created
|
| 688 | Basic Application Group Changed
|
| 694 | LDAP Query Group Created
|
| 695 | LDAP Query Group Changed
|