ID Event Description
4624 An account was successfully logged on
4625 An account failed to log on
4626 User / Device claims information
4627 Group membership information
4634 An account was logged off
4647 User initiated logoff
4648 A logon was attempted using explicit credentials
4688 A new process has been created
4696 A primary token was assigned to process
4703 A token right was adjusted
4720 A user account was created
4722 A user account was enabled
4723 An attempt was made to change an account's password
4724 An attempt was made to reset an account's password
4725 A user account was disabled
4726 A user account was deleted
4727 A security-enabled global group was created
4728 A member was added to a security-enabled global group
4729 A member was removed from a security-enabled global group
4730 A security-enabled global group was deleted
4731 A security-enabled local group was created
4732 A member was added to a security-enabled local group
4733 A member was removed from a security-enabled local group
4734 A security-enabled local group was deleted
4735 A security-enabled local group was changed
4737 A security-enabled global group was changed
4738 A user account was changed
4740 A user account was locked out
4741 A computer account was created
4742 A computer account was changed
4743 A computer account was deleted
4744 A security-disabled local group was created
4745 A security-disabled local group was changed
4746 A member was added to a security-disabled local group
4747 A member was removed from a security-disabled local group
4748 A security-disabled local group was deleted
4749 A security-disabled global group was created
4750 A security-disabled global group was changed
4751 A member was added to a security-disabled global group
4752 A member was removed from a security-disabled global group
4753 A security-disabled global group was deleted
4754 A security-enabled universal group was created
4755 A security-enabled universal group was changed
4756 A member was added to a security-enabled universal group
4757 A member was removed from a security-enabled universal group
4758 A security-enabled universal group was deleted
4759 A security-disabled universal group was created
4760 A security-disabled universal group was changed
4761 A member was added to a security-disabled universal group
4762 A member was removed from a security-disabled universal group
4763 A security-disabled universal group was deleted
4764 A group’s type was changed
4767 A user account was unlocked
4768 This event generates every time Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT).
4769 A Kerberos service ticket was requested
4770 A Kerberos service ticket was renewed
4781 The name of an account was changed
4782 The password hash an account was accessed
4797 An attempt was made to query the existence of a blank password for an account
4798 A user's local group membership was enumerated
4799 A security-enabled local group membership was enumerated
4800 The workstation was locked
4801 The workstation was unlocked