| ID | Event Description |
|---|
| 4624 | An account was successfully logged on
CJIS, Audit Success, ISO 27001:2013, HIPAA, NIST SP 800-53, CMMC L1, NIST 800-171, PCI-DSS |
| 4627 | Group membership information
Audit Success |
| 4634 | An account was logged off
Audit Success |
| 4647 | User initiated logoff
Audit Success |
| 4661 | A handle to an object was requested
Domain Controller, Audit Success, Audit Failure |
| 4662 | An operation was performed on an object
Domain Controller, Audit Success, Audit Failure |
| 4673 | A privileged service was called
Audit Success, CMMC L2, NIST800-171, NIST800-53 |
| 4674 | An operation was attempted on a privileged object
Audit Failure, Audit Success, CMMC L2, NIST800-171, NIST800-53 |
| 4688 | A new process has been created
NIST 800-171, NIST SP 800-53, Audit Success, ISO 27001:2013, CMMC L3 |
| 4689 | A process has exited
Audit Success |
| 4769 | A Kerberos service ticket was requested
Domain Controller, Audit Success, Audit Failure, CJIS, ISO 27001:2013, HIPAA, NIST 800-171, NIST SP 800-53, CMMC L1 |
| 4770 | A Kerberos service ticket was renewed
Domain Controller, Audit Success |
| 4776 | The computer attempted to validate the credentials for an account
Audit Failure, Audit Success, CJIS, ISO 27001:2013, PCI-DSS, HIPAA, NIST 800-171, NIST SP 800-53, CMMC L1 |
| 4928 | An Active Directory replica source naming context was established
Domain Controller, Audit Success, Audit Failure |
| 4929 | An Active Directory replica source naming context was removed
Domain Controller, Audit Success, Audit Failure |
| 5145 | A network share object was checked to see whether client can be granted desired access.
Audit Success, Audit Failure |
| 5152 | The Windows Filtering Platform has blocked a packet.
Audit Failure |
| 5153 | A more restrictive Windows Filtering Platform filter has blocked a packet.
Audit Success |
| 5156 | The Windows Filtering Platform has allowed a connection.
Audit Success |
| 5157 | The Windows Filtering Platform has blocked a connection.
Audit Failure |
| 5158 | The Windows Filtering Platform has permitted a bind to a local port.
Audit Success |
| 5168 | Spn check for SMB/SMB2 fails.
Audit Failure |
| 5379 | Records instances where Credential Manager credentials were read
|
| 5447 | A Windows Filtering Platform filter has been changed.
Audit Success |
| 5451 | An IPsec quick mode security association was established.
|
| 5452 | An IPsec quick mode security association ended.
|
| 5463 | PAStore Engine polled for changes to the active IPsec policy and detected no changes
|