EventID

From WikiWiki
Jump to navigation Jump to search

Bunch of usefull/related Windows Event ID's


shutdown

1074,1076,12,6008,41


logon

4624

Logon Type Description
2 Interactive (logon at keyboard and screen of system)
3 Network (i.e. connection to shared folder on this computer from elsewhere on network)
4 Batch (i.e. scheduled task)
5 Service (Service startup)
10 RemoteInteractive (Terminal Services, Remote Desktop or Remote Assistance)


groups

ID oldID impact Description
4756 660 Low A member was added to a security-enabled universal group.
4757 661 Low A member was removed from a security-enabled universal group.
4732 636 Low A member was added to a security-enabled local group.
4733 637 Low A member was removed from a security-enabled local group.
4728 632 Low A member was added to a security-enabled global group.
4729 633 Low A member was removed from a security-enabled global group.

ADDS

ID Description
5136 A directory service object was modified.