System32
Events
Compliance
Validator
TLS/SSL
Codes
GeoIP
Tools
Audit Category
Account Management
(7)
Account Logon
(2)
Logon/Logoff
(2)
Policy Change
(2)
Audit Subcategory
User Account Management
(5)
Authorization Policy Change
(2)
Logon
(2)
Security Group Management
(2)
Account Lockout
(1)
Credential Validation
(1)
Kerberos Service Ticket Operations
(1)
Operating Systems
Windows 2008 R2
(13)
Windows 2012 R2
(13)
Windows 2016
(13)
Windows 2019
(13)
Windows 2008
(12)
Windows 2012
(12)
Windows 10
(11)
Windows 7
(11)
Windows 8
(11)
Windows 8.1
(11)
Windows Vista
(11)
Tags
CMMC L1
(13)
ISO 27001:2013
(13)
NIST 800-171
(13)
NIST SP 800-53
(13)
Audit Success
(11)
PCI-DSS
(6)
CJIS
(4)
HIPAA
(4)
Audit Failure
(3)
CMMC L3
(2)
Domain Controller
(2)
ID
Event Description
4624
An account was successfully logged on
4625
An account failed to log on
4704
A user right was assigned
4705
A user right was removed
4720
A user account was created
4722
A user account was enabled
4725
A user account was disabled
4726
A user account was deleted
4728
A member was added to a security-enabled global group
4732
A member was added to a security-enabled local group
4738
A user account was changed
4769
A Kerberos service ticket was requested
4776
The computer attempted to validate the credentials for an account