EventID
Jump to navigation
Jump to search
Bunch of usefull/related Windows Event ID's
shutdown
1074,1076,12,6008,41
logon
4624
Logon Type | Description |
---|---|
2 | Interactive (logon at keyboard and screen of system) |
3 | Network (i.e. connection to shared folder on this computer from elsewhere on network) |
4 | Batch (i.e. scheduled task) |
5 | Service (Service startup) |
10 | RemoteInteractive (Terminal Services, Remote Desktop or Remote Assistance) |
groups
ID | oldID | impact | Description |
---|---|---|---|
4756 | 660 | Low | A member was added to a security-enabled universal group. |
4757 | 661 | Low | A member was removed from a security-enabled universal group. |
4732 | 636 | Low | A member was added to a security-enabled local group. |
4733 | 637 | Low | A member was removed from a security-enabled local group. |
4728 | 632 | Low | A member was added to a security-enabled global group. |
4729 | 633 | Low | A member was removed from a security-enabled global group. |
ADDS
ID | Description |
---|---|
5136 | A directory service object was modified. |