Audit Category
Audit Subcategory
Operating Systems
Tags
Auditing
Volume
EventSentry
ID Event Description
1100 The event logging service has shut down
Audit Success, PCI-DSS
1101 Audit Events Have Been Dropped By The Transport
CJIS, PCI-DSS, ISO 27001:2013
1102 The audit log was cleared
CJIS, ISO 27001:2013, PCI-DSS
1104 The security event log is now full
CJIS, PCI-DSS, ISO 27001:2013
5024 The Windows Firewall service started successfully.
Audit Success
5025 The Windows Firewall service was stopped.
Audit Success
5027 The Windows Firewall service was unable to retrieve the security policy from the local storage.
Audit Failure
5028 Windows Firewall was unable to parse the new security policy.
Audit Failure
5029 The Windows Firewall service failed to initialize the driver.
Audit Failure
5030 The Windows Firewall service failed to start.
Audit Failure
5032 Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network.
Audit Failure
5033 The Windows Firewall Driver started successfully.
Audit Success
5034 The Windows Firewall Driver was stopped.
Audit Success
5035 The Windows Firewall Driver failed to start.
Audit Failure
5037 The Windows Firewall Driver detected a critical runtime error.
Audit Failure
5050 An attempt to programmatically disable Windows Firewall was rejected.
5058 Key file operation.
Audit Success, Audit Failure
5059 Key migration operation.
Audit Success, Audit Failure
5071 Key access denied by Microsoft key distribution service.
6400 BranchCache: Received an incorrectly formatted response while discovering availability of content.
6401 BranchCache: Received invalid data from a peer. Data discarded.
6402 BranchCache: The message to the hosted cache offering it data is incorrectly formatted.
6403 BranchCache: The hosted cache sent an incorrectly formatted response to the client's message to offer it data.
6404 BranchCache: Hosted cache could not be authenticated using the provisioned SSL certificate.
6405 BranchCache: %2 instance(s) of event id %1 occurred.
6406 %1 registered to Windows Firewall to control filtering for the following: %2.
6407 n/a
6408 Registered product %1 failed and Windows Firewall is now controlling the filtering for %2.
6409 BranchCache: A service connection point object could not be parsed.