EventSentry
  • System32
  • Sysmon
  • Events
  • Compliance
  • Validator
  • TLS/SSL
  • GeoIP
  • Tools


Windows Security Events



Audit Category
  • Account Management (3)
  • Account Logon (1)
Operating Systems
  • Windows 2008 (4)
  • Windows 2008 R2 (4)
  • Windows 2012 (4)
  • Windows 2012 R2 (4)
  • Windows 2016 (4)
  • Windows 2019 (4)
  • Windows 2022 (4)
  • Windows 10 (3)
  • Windows 11 (3)
  • Windows 7 (3)
  • Windows 8 (3)
  • Windows 8.1 (3)
  • Windows Vista (3)
Tags
  • Audit Success (3)
  • Audit Failure (2)
  • Domain Controller (2)
  • CJIS (1)
  • CMMC L1 (1)
  • HIPAA (1)
  • ISO 27001:2013 (1)
  • NIST 800-171 (1)
  • NIST SP 800-53 (1)
  • PCI-DSS (1)
Auditing
  • Always (2)
  • Conditional (1)
Volume
  • Low (2)
  • High (1)
  • Medium (1)
Audit Subcategory
  • User Account Management (2)
  • Credential Validation (1)
  • Other Account Management Events (1)

AppLocker
  • All AppLocker events
EventSentry
  • All EventSentry events
Security
  • All Windows Security events
Sysmon
  • All Sysmon events
ID Event Description
4776 The computer attempted to validate the credentials for an account
Audit Failure, Audit Success, CJIS, ISO 27001:2013, PCI-DSS, HIPAA, NIST 800-171, NIST SP 800-53, CMMC L1
4793 The Password Policy Checking API was called
Domain Controller, Audit Success
4794 An attempt was made to set the Directory Services Restore Mode administrator password
Domain Controller, Audit Success, Audit Failure
4797 An attempt was made to query the existence of a blank password for an account



© netikus.net ltd 2002-2025 | EventSentry | Event Log Messages | Codes | Sysmon | STIG | AppLocker | Privacy Policy