| ID | Event Description |
|---|---|
| 4671 | An application attempted to access a blocked ordinal through the TBS |
| 4691 | Indirect access to an object was requested Audit Success |
| 4698 | A scheduled task was created Audit Success, PCI-DSS |
| 4699 | A scheduled task was deleted Audit Success, PCI-DSS |
| 4700 | A scheduled task was enabled Audit Success |
| 4701 | A scheduled task was disabled Audit Success |
| 4702 | A scheduled task was updated Audit Success, PCI-DSS |
| 5148 | The Windows Filtering Platform has detected a DoS attack. Audit Failure |
| 5149 | The DoS attack has subsided and normal processing is being resumed. Audit Failure |
| 5888 | An object in the COM+ Catalog was modified. Audit Success |
| 5889 | An object was deleted from the COM+ Catalog. Audit Success |
| 5890 | An object was added to the COM+ Catalog. Audit Success |