System32
Events
Compliance
Validator
TLS/SSL
Codes
GeoIP
Tools
Audit Category
Object Access
(4)
Account Logon
(2)
DS Access
(2)
Privilege Use
(2)
Logon/Logoff
(1)
Audit Subcategory
Directory Service Access
(2)
Filtering Platform Packet Drop
(2)
Kerberos Service Ticket Operations
(2)
Sensitive Privilege Use
(2)
Detailed File Share
(1)
Filtering Platform Connection
(1)
Logon
(1)
Non Sensitive Privilege Use
(1)
SAM
(1)
Operating Systems
Windows 2008 R2
(11)
Windows 2012
(11)
Windows 2012 R2
(11)
Windows 2016
(11)
Windows 2019
(11)
Windows 2008
(10)
Windows 10
(9)
Windows 7
(9)
Windows 8
(9)
Windows 8.1
(9)
Windows Vista
(7)
Tags
Audit Success
(10)
Audit Failure
(6)
Domain Controller
(4)
CJIS
(2)
CMMC L1
(2)
HIPAA
(2)
ISO 27001:2013
(2)
NIST 800-171
(2)
NIST SP 800-53
(2)
Auditing
Rarely
(6)
Conditional
(4)
Volume
High
(11)
Very high
(11)
Medium
(4)
Low
(1)
ID
Event Description
4624
An account was successfully logged on
CJIS, Audit Success, ISO 27001:2013, HIPAA, NIST SP 800-53, CMMC L1, NIST 800-171
4661
A handle to an object was requested
Domain Controller, Audit Success, Audit Failure
4662
An operation was performed on an object
Domain Controller, Audit Success, Audit Failure
4673
A privileged service was called
Audit Success
4674
An operation was attempted on a privileged object
Audit Failure, Audit Success
4769
A Kerberos service ticket was requested
Domain Controller, Audit Success, Audit Failure, CJIS, ISO 27001:2013, HIPAA, NIST 800-171, NIST SP 800-53, CMMC L1
4770
A Kerberos service ticket was renewed
Domain Controller, Audit Success
5145
A network share object was checked to see whether client can be granted desired access.
Audit Success, Audit Failure
5152
The Windows Filtering Platform has blocked a packet.
Audit Failure
5153
A more restrictive Windows Filtering Platform filter has blocked a packet.
Audit Success
5156
The Windows Filtering Platform has allowed a connection.
Audit Success