| ID |
Event Description |
|
4624
|
An account was successfully logged on
CJIS, Audit Success, ISO 27001:2013, HIPAA, NIST SP 800-53, CMMC L1, NIST 800-171
|
|
4625
|
An account failed to log on
Audit Failure, CJIS, ISO 27001:2013, PCI-DSS, HIPAA, NIST SP 800-53, NIST 800-171, CMMC L1
|
|
4626
|
User / Device claims information
Audit Success
|
|
4627
|
Group membership information
Audit Success
|
|
4634
|
An account was logged off
Audit Success
|
|
4648
|
A logon was attempted using explicit credentials
Audit Success
|
|
4674
|
An operation was attempted on a privileged object
Audit Failure, Audit Success
|
|
4688
|
A new process has been created
NIST 800-171, NIST SP 800-53, Audit Success, ISO 27001:2013, CMMC L3
|
|
4689
|
A process has exited
Audit Success
|
|
4776
|
The computer attempted to validate the credentials for an account
Audit Failure, Audit Success, CJIS, ISO 27001:2013, PCI-DSS, HIPAA, NIST 800-171, NIST SP 800-53, CMMC L1
|
|
4778
|
A session was reconnected to a Window Station
Audit Success, NIST 800-171, NIST SP 800-53, CMMC L3
|
|
4779
|
A session was disconnected from a Window Station
Audit Success, NIST 800-171, NIST SP 800-53, CMMC L3
|
|
4802
|
The screen saver was invoked
ISO 27001:2013, Audit Success, NIST 800-171, NIST SP 800-53, CMMC L3
|
|
4803
|
The screen saver was dismissed
ISO 27001:2013, Audit Success, NIST 800-171, NIST SP 800-53, CMMC L3
|
|
5140
|
A network share object was accessed
Audit Success, Audit Failure
|
|
5145
|
A network share object was checked to see whether client can be granted desired access.
Audit Success, Audit Failure
|
|
5153
|
A more restrictive Windows Filtering Platform filter has blocked a packet.
Audit Success
|
|
5158
|
The Windows Filtering Platform has permitted a bind to a local port.
Audit Success
|