ID Event Description
4624 An account was successfully logged on
CJIS, Audit Success, ISO 27001:2013, HIPAA, NIST SP 800-53, CMMC L1, NIST 800-171
4627 Group membership information
Audit Success
4634 An account was logged off
Audit Success
4647 User initiated logoff
Audit Success
4661 A handle to an object was requested
Domain Controller, Audit Success, Audit Failure
4662 An operation was performed on an object
Domain Controller, Audit Success, Audit Failure
4673 A privileged service was called
Audit Success
4674 An operation was attempted on a privileged object
Audit Failure, Audit Success
4688 A new process has been created
NIST 800-171, NIST SP 800-53, Audit Success, ISO 27001:2013, CMMC L3
4689 A process has exited
Audit Success
4769 A Kerberos service ticket was requested
Domain Controller, Audit Success, Audit Failure, CJIS, ISO 27001:2013, HIPAA, NIST 800-171, NIST SP 800-53, CMMC L1
4770 A Kerberos service ticket was renewed
Domain Controller, Audit Success
4776 The computer attempted to validate the credentials for an account
Audit Failure, Audit Success, CJIS, ISO 27001:2013, PCI-DSS, HIPAA, NIST 800-171, NIST SP 800-53, CMMC L1
4928 An Active Directory replica source naming context was established
Domain Controller, Audit Success, Audit Failure
4929 An Active Directory replica source naming context was removed
Domain Controller, Audit Success, Audit Failure
5145 A network share object was checked to see whether client can be granted desired access.
Audit Success, Audit Failure
5152 The Windows Filtering Platform has blocked a packet.
Audit Failure
5153 A more restrictive Windows Filtering Platform filter has blocked a packet.
Audit Success
5156 The Windows Filtering Platform has allowed a connection.
Audit Success
5157 The Windows Filtering Platform has blocked a connection.
Audit Failure
5158 The Windows Filtering Platform has permitted a bind to a local port.
Audit Success