| ID | Event Description |
|---|
| 4649 | A replay attack was detected
Domain Controller, Audit Success, Audit Failure, PCI-DSS, HIPAA, CJIS, ISO 27001:2013 |
| 4661 | A handle to an object was requested
Domain Controller, Audit Success, Audit Failure |
| 4662 | An operation was performed on an object
Domain Controller, Audit Success, Audit Failure |
| 4675 | SIDs were filtered
Domain Controller, Audit Success |
| 4706 | A new trust was created to a domain
Domain Controller, Audit Success |
| 4707 | A trust to a domain was removed
Domain Controller, Audit Success |
| 4713 | Kerberos policy was changed
Domain Controller, Audit Success |
| 4716 | Trusted domain information was modified
Domain Controller, Audit Success |
| 4727 | A security-enabled global group was created
Domain Controller |
| 4728 | A member was added to a security-enabled global group
Domain Controller, ISO 27001:2013, NIST 800-171, NIST SP 800-53, CMMC L1 |
| 4729 | A member was removed from a security-enabled global group
Domain Controller |
| 4730 | A security-enabled global group was deleted
Domain Controller |
| 4737 | A security-enabled global group was changed
Domain Controller |
| 4739 | Domain Policy was changed
Domain Controller, NIST 800-171, NIST SP 800-53, ISO 27001:2013, Audit Success, CMMC L3 |
| 4741 | A computer account was created
Domain Controller, Audit Success |
| 4742 | A computer account was changed
Domain Controller, Audit Success |
| 4743 | A computer account was deleted
Domain Controller, Audit Success |
| 4749 | A security-disabled global group was created
Domain Controller, Audit Success |
| 4750 | A security-disabled global group was changed
Domain Controller, Audit Success |
| 4751 | A member was added to a security-disabled global group
Domain Controller, Audit Success |
| 4752 | A member was removed from a security-disabled global group
Domain Controller, Audit Success |
| 4753 | A security-disabled global group was deleted
Domain Controller, Audit Success |
| 4754 | A security-enabled universal group was created
Domain Controller |
| 4755 | A security-enabled universal group was changed
Domain Controller |
| 4756 | A member was added to a security-enabled universal group
Domain Controller, ISO 27001:2013 |
| 4757 | A member was removed from a security-enabled universal group
Domain Controller |
| 4758 | A security-enabled universal group was deleted
Domain Controller |
| 4759 | A security-disabled universal group was created
Domain Controller |
| 4760 | A security-disabled universal group was changed
Domain Controller |
| 4761 | A member was added to a security-disabled universal group
Domain Controller |
| 4762 | A member was removed from a security-disabled universal group
Domain Controller |
| 4763 | A security-disabled universal group was deleted
Domain Controller |
| 4764 | A group’s type was changed
Domain Controller, Audit Success |
| 4765 | SID History was added to an account
Domain Controller, Audit Success |
| 4766 | An attempt to add SID History to an account failed
Domain Controller, Audit Failure |
| 4768 | This event generates every time Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT).
Domain Controller, Audit Success, Audit Failure, CJIS, ISO 27001:2013, PCI-DSS, NIST 800-171, NIST SP 800-53 |
| 4769 | A Kerberos service ticket was requested
Domain Controller, Audit Success, Audit Failure, CJIS, ISO 27001:2013, HIPAA, NIST 800-171, NIST SP 800-53, CMMC L1 |
| 4770 | A Kerberos service ticket was renewed
Domain Controller, Audit Success |
| 4771 | Kerberos pre-authentication failed
Domain Controller, Audit Failure, CJIS, ISO 27001:2013, PCI-DSS, HIPAA, NIST 800-171, NIST SP 800-53, CMMC-L2 |
| 4772 | A Kerberos authentication ticket request failed
Domain Controller, Audit Failure, Not Implemented |
| 4773 | A Kerberos service ticket request failed
Domain Controller, Audit Failure, Not Implemented |
| 4774 | An account was mapped for logon
Domain Controller, Audit Success, Audit Failure |
| 4775 | An account could not be mapped for logon
Domain Controller, Audit Failure |
| 4780 | The ACL was set on accounts which are members of administrators groups
Domain Controller, Audit Success |
| 4782 | The password hash of an account was accessed
Domain Controller, Audit Success |
| 4783 | A basic application group was created
Domain Controller, Audit Success |
| 4784 | A basic application group was changed
Domain Controller, Audit Success |
| 4785 | A member was added to a basic application group
Domain Controller, Audit Success |
| 4786 | A member was removed from a basic application group
Domain Controller, Audit Success |
| 4787 | A non-member was added to a basic application group
Domain Controller, Audit Success |
| 4788 | A non-member was removed from a basic application group
Domain Controller, Audit Success |
| 4789 | A basic application group was deleted
Domain Controller, Audit Success |
| 4790 | An LDAP query group was created
Domain Controller, Audit Success |
| 4791 | A basic application group was changed
Domain Controller, Audit Success |
| 4792 | An LDAP query group was deleted
Domain Controller, Audit Success |
| 4793 | The Password Policy Checking API was called
Domain Controller, Audit Success |
| 4794 | An attempt was made to set the Directory Services Restore Mode administrator password
Domain Controller, Audit Success, Audit Failure |
| 4820 | A Kerberos Ticket-granting-ticket (TGT) was denied because the device does not meet the access control restrictions
Domain Controller |
| 4821 | A Kerberos service ticket was denied because the user, device, or both does not meet the access control restrictions
Domain Controller |
| 4824 | Kerberos preauthentication by using DES or RC4 failed because the account was a member of the Protected User group
Domain Controller |
| 4928 | An Active Directory replica source naming context was established
Domain Controller, Audit Success, Audit Failure |
| 4929 | An Active Directory replica source naming context was removed
Domain Controller, Audit Success, Audit Failure |
| 4930 | An Active Directory replica source naming context was modified
Domain Controller, Audit Success, Audit Failure |
| 4931 | An Active Directory replica destination naming context was modified
Domain Controller, Audit Success, Audit Failure |
| 4932 | Synchronization of a replica of an Active Directory naming context has begun
Audit Success, Audit Failure, Domain Controller |
| 4933 | Synchronization of a replica of an Active Directory naming context has ended
Audit Success, Audit Failure, Domain Controller |
| 4934 | Attributes of an Active Directory object were replicated
Domain Controller, Audit Success, Audit Failure |
| 4935 | Replication failure begins
Domain Controller, Audit Success, Audit Failure |
| 4936 | Replication failure ends
Domain Controller, Audit Success, Audit Failure |
| 5136 | A directory service object was modified
Domain Controller, Audit Success |
| 5137 | A directory service object was created
Domain Controller, Audit Success |
| 5138 | A directory service object was undeleted.
Domain Controller, Audit Success |
| 5139 | A directory service object was moved.
Domain Controller, Audit Success |
| 5141 | A directory service object was deleted.
Domain Controller, Audit Success |
| 5169 | A directory service object was modified.
Domain Controller, Audit Success, Audit Failure |