Windows Event IDs

Event ID 4624

Successful Logon

Event ID 4625

Failed Logon

Event ID 4688

A new process has been created

Event ID 4634

An account was logged off

Event ID 4648

A logon was attempted using explicit credentials

Event ID 4672

Special privileges assigned to new logon

Event ID 4720

A user account was created

Event ID 4722

A user account was enabled

Event ID 4724

An attempt was made to reset an account's password

Event ID 4728

A member was added to a security-enabled global group

Event ID 4732

A member was added to a security-enabled local group

Event ID 5140

A network share object was accessed

Event ID 7045

A new service was installed in the system

Event ID 1102

The security audit log was cleared

Event ID 104

The system log was cleared

Event ID 4698

A scheduled task was created

Event ID 4719

System audit policy was changed

Event ID 4656

A handle to an object was requested

Event ID 4663

An attempt was made to access an object

Event ID 4769

A Kerberos service ticket was requeste