ID Event Description
4656 A handle to an object was requested
4658 The handle to an object was closed
4661 A handle to an object was requested
4662 An operation was performed on an object
4663 An attempt was made to access an object
4692 Backup of data protection master key was attempted
4693 Recovery of data protection master key was attempted
4694 Protection of auditable protected data was attempted
4695 Unprotection of auditable protected data was attempted
4768 This event generates every time Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT).
4769 A Kerberos service ticket was requested
4770 A Kerberos service ticket was renewed
4776 The computer attempted to validate the credentials for an account
4783 A basic application group was created
4784 A basic application group was changed
4785 A member was added to a basic application group
4786 A member was removed from a basic application group
4787 A non-member was added to a basic application group
4788 A non-member was removed from a basic application group
4789 A basic application group was deleted
4790 An LDAP query group was created
4791 A basic application group was changed
4792 An LDAP query group was deleted
4928 An Active Directory replica source naming context was established
4929 An Active Directory replica source naming context was removed
4930 An Active Directory replica source naming context was modified
4931 An Active Directory replica destination naming context was modified
4932 Synchronization of a replica of an Active Directory naming context has begun
4933 Synchronization of a replica of an Active Directory naming context has ended
4934 Attributes of an Active Directory object were replicated
4935 Replication failure begins
4936 Replication failure ends
5136 A directory service object was modified
5137 A directory service object was created
5138 A directory service object was undeleted.
5139 A directory service object was moved.
5141 A directory service object was deleted.
5169 A directory service object was modified.
6419 A request was made to disable a device.
6420 A device was disabled.
6421 A request was made to enable a device.
6422 A device was enabled.
6423 The installation of this device is forbidden by system policy.
6424 The installation of this device was allowed, after having previously been forbidden by policy.