ID |
Event Description |
4624
|
An account was successfully logged on
CJIS, Audit Success, ISO 27001:2013, HIPAA, NIST SP 800-53, CMMC L1, NIST 800-171
|
4627
|
Group membership information
Audit Success
|
4634
|
An account was logged off
Audit Success
|
4647
|
User initiated logoff
Audit Success
|
4661
|
A handle to an object was requested
Domain Controller, Audit Success, Audit Failure
|
4662
|
An operation was performed on an object
Domain Controller, Audit Success, Audit Failure
|
4673
|
A privileged service was called
Audit Success
|
4674
|
An operation was attempted on a privileged object
Audit Failure, Audit Success
|
4688
|
A new process has been created
NIST 800-171, NIST SP 800-53, Audit Success, ISO 27001:2013, CMMC L3
|
4689
|
A process has exited
Audit Success
|
4769
|
A Kerberos service ticket was requested
Domain Controller, Audit Success, Audit Failure, CJIS, ISO 27001:2013, HIPAA, NIST 800-171, NIST SP 800-53, CMMC L1
|
4770
|
A Kerberos service ticket was renewed
Domain Controller, Audit Success
|
4776
|
The computer attempted to validate the credentials for an account
Audit Failure, Audit Success, CJIS, ISO 27001:2013, PCI-DSS, HIPAA, NIST 800-171, NIST SP 800-53, CMMC L1
|
4928
|
An Active Directory replica source naming context was established
Domain Controller, Audit Success, Audit Failure
|
4929
|
An Active Directory replica source naming context was removed
Domain Controller, Audit Success, Audit Failure
|
5145
|
A network share object was checked to see whether client can be granted desired access.
Audit Success, Audit Failure
|
5152
|
The Windows Filtering Platform has blocked a packet.
Audit Failure
|
5153
|
A more restrictive Windows Filtering Platform filter has blocked a packet.
Audit Success
|
5156
|
The Windows Filtering Platform has allowed a connection.
Audit Success
|
5157
|
The Windows Filtering Platform has blocked a connection.
Audit Failure
|
5158
|
The Windows Filtering Platform has permitted a bind to a local port.
Audit Success
|