Audit Policies and Event Logs


1	#	Category	Item	DC	Svr	WS	Outcome	Event ID	Event Description	Comment

2	1	Account Logon	Audit Credential Validation	Yes	Yes	Yes	Success	4774	An account was mapped for logon - Success
3	2			Yes	Yes	Yes	Success	4776	The computer attempted to validate the credentials for an account - Success
4	3			Yes	Yes	Yes	Failure	4775	An account could not be mapped for logon
5	4							4774	An account was mapped for logon - Failure
6	5							4776	The computer attempted to validate the credentials for an account - Failure
7	6							4777	The domain controller failed to validate the credentials for an account
8	7	Account Logon	Kerberos Authentication Service	Yes	No	No	Success	4768	A Kerberos authentication ticket (TGT) was requested - Success
9	8			Yes	No	No	Failure	4768	A Kerberos authentication ticket (TGT) was requested - Failure
10	9							4771	Kerberos pre-authentication failed
11	10							4772	A Kerberos authentication ticekt request failed
12	11	Account Logon	Kerberos Service Ticket Operations	Yes	No	No	Success	4769	A Kerberos service ticket was required - Success
13	12			Yes	No	No	Success	4770	A Kerberos service ticket was renewed
14	13			Yes	No	No	Failure	4769	A Kerberos service ticket was required - Failure
15	14			Yes	No	No	Failure	4773	A Kerberos service ticket request failed
16	15	Account Logon	Other Account Logon Events	No	No	No	-	-	-
17	16	Account Management	Application Group Management	-	-	-	Success	4783	A basic application group was created
18	17							4784	A basic application group was changed
19	18							4785	A member was added to a basic application group
20	19							4787	A non-member was addedd to a basic application group
21	20							4788	A non-member was removed from a basic application group
22	21							4789	A basic application group was deleted
23	22							4790	An LDAP query group was created
24	23							4791	An LDAP query group was changed
25	24							4792	An LDAP query group was deleted
26	25			-	-	-	Failure	-	-
27	26	Account Management	Computer Account Management	Yes	No	No	Success	4741	A computer account was created
28	27							4742	A computer account was changed
29	28							4743	A computer account was deleted
30	29			No	No	No	Failure	-	-
31	30	Account Management	Distribution Group Manangement	Yes	No	No	Success	4749	A security-disabled (distribution) Global group was created
32	31							4750	A security-disabled (distribution) Global group was changed
33	32							4751	A member was added to a security-disabled (distribution) Global group
34	33							4752	A member was removed to a security-disabled (distribution) Global group
35	34							4753	A security-disabled (distribution) Global group was deleted
36	35							4759	A security-disabled (distribution) Universal group was created; see 4749
37	36							4760	A security-disabled (distribution) Universal group was changed; see 4750
38	37							4761	A member was added to a security-disabled (distribution) Universal group; see 4751
39	38							4762	A member was removed to a security-disabled (distribution) Universal group; see 4752
40	39							4763	A security-disabled (distribution) Universal group was deleted; see 4753
41	40							4744	A security-disabled (distribution) Local group was created; see 4749
42	41							4745	A security-disabled (distribution) Local group was changed; see 4750
43	42							4746	A member was added to a security-disabled (distribution) Local group; see 4751
44	43							4747	A member was removed to a security-disabled (distribution) Local group; see 4752
45	44							4748	A security-disabled (distribution) Local group was deleted; see 4753
46	45			No	No	No	Failure	-	-
47	46	Account Management	Other Account Management Events	Yes	No	No	Success	4782	The password hash of an account was accessed
48	47			Yes	No	No	Success	4793	The Password Policy Checking API was called
49	48			No	No	No	Failure	-	-
50	49	Account Management	Security Group Management	Yes	Yes	Yes	Success	4731	A security-enabled Local group was created
51	50							4732	A member was added to a security-enabled Local group
52	51							4733	A member was removed from a security-enabled Local group
53	52							4734	A security-enabled Local group was deleted
54	53							4735	A security-enabled Local group was changed
55	54							4764	A group's type was changed
56	55							4799	A security-enabled Local group membership was enumerated
57	56							4727	A security-enabled Global group was created; see 4731 (ignore Local section)
58	57							4728	A member was added to a security-enabled Global group; see 4732 (ignore Local section)
59	58							4729	A member was removed from a security-enabled Global group; see 4733 (ignore Local section)
60	59							4730	A security-enabled Global group was deleted; see 4734 (ignore Local section)
61	60							4737	A security-enabled Global group was changed; see 4735 (ignore Local section)
62	61							4754	A security-enabled Universal group was created; see 4731 (ignore Local section)
63	62							4756	A member was added to a security-enabled Universal group; see 4732 (ignore Local section)
64	63							4757	A member was removed from a security-enabled Universal group; see 4733 (ignore Local section)
65	64							4758	A security-enabled Universal group was deleted; see 4734 (ignore Local section)
66	65							4755	A security-enabled Universal group was changed; see 4735 (ignore Local section)
67	66			No	No	No	Failure	-	-
68	67	Account Management	User Account Management	Yes	Yes	Yes	Success	4720	A user account was created
69	68							4722	A user account was enabled
70	69							4723	An attempt was made to change an account's password - Success
71	70							4724	An attempt was made to reset an account's password - Success
72	71							4725	A user account was disabled
73	72							4726	A user account was deleted
74	73							4738	A user account was changed
75	74							4740	A user account was locked out
76	75							4765	SID History was added to an account
77	76							4767	A user account was unlocked
78	77							4780	The ACL was set on accounts which are members of administrators groups
79	78							4781	The name of an account was changed
80	79							4794	An attempt was made to set the Directory Service Restore Mode administrator password - Success
81	80							4798	A user's local group membership was enumerated
82	81							5376	Credential Manager credentials were backed up
83	82							5377	Credential Manager credentials were restored from backup
84	83			Yes	Yes	Yes	Failure	4723	An attempt was made to change an account's password - Failure
85	84							4724	An attempt was made to reset an account's password - Failure
86	85							4766	An attempt to add sID History to an account failed
87	86							4794	An attempt was made to set the Directory Service Restore Mode administrator password - Failure
88	87	Detailed Tracking	DPAPI Activity	No	No	No	Success	4692	Backup of data protection master keys was attempted - Success
89	88							4693	Recovery of data protection master keys was attempted - Success
90	89							4694	Protection of auditable protected data was attempted - Success
91	90							4695	Unprotection of audtiable protected data was attempted - Success
92	91			No	No	No	Failure	4692	Backup of data protection master keys was attempted - Failure
93	92							4693	Recovery of data protection master keys was attempted - Failure
94	93							4694	Protection of auditable protected data was attempted - Failure
95	94							4695	Unprotection of audtiable protected data was attempted - Failure
96	95	Detailed Tracking	PNP Activity	Yes	Yes	Yes	Success	6416	A new external device was recognised by the System
97	96							6419	A request was made too disable a device
98	97							6420	A device was disabled
99	98							6421	A request was made to enable a device
100	99							6422	A device was enabled
101	100							6423	The installation of this device is forbidden by system policy
102	101							6424	The installation of this device was allowed, after having previously been forbidden by policy
103	102			No	No	No	Failure	-	-
104	103	Detailed Tracking	Process Creation	Yes	Yes	Yes	Success	4688	A new process has been created
105	104			Yes	Yes	Yes	Success	4696	A primary token was assigned to process
106	105			No	No	No	Failure	-	-
107	106	Detailed Tracking	Process Termination	No	No	No	Success	4689	A process has exited
108	107	Detailed Tracking	Process Termination	No	No	No	Failure	-	-
109	108	Detailed Tracking	RPC Events	No	No	No	Success	5712	A Remote Procedure Call (RPC) was attempted
110	109	Detailed Tracking	RPC Events	No	No	No	Failure	-	-
111	110	Detailed Tracking	Token Right Adjusted	No	No	No	Success	4703	A user right was adjusted
112	111	Detailed Tracking	Token Right Adjusted	No	No	No	Failure	-	-
113	112	DS Access	Detailed Directory Service Replication	No	No	No	Success	4928	An Active Directory replica source naming context was established - Sucess
114	113							4929	An Active Directory replica source naming context was removed - Success
115	114							4930	An Active Directory replica source naming context was modified - Success
116	115							4931	An Active Directory replica destination naming context was modified - Success
117	116							4934	Attributes of an Active Directory object were replicated
118	117							4936	Replication failure ends
119	118							4937	A lingering object was removed from a replica
120	119			No	No	No	Failure	4928	An Active Directory replica source naming context was established - Failure
121	120							4929	An Active Directory replica source naming context was removed - Failure
122	121							4930	An Active Directory replica source naming context was modified - Failure
123	122							4931	An Active Directory replica destination naming context was modified - Failure
124	123							4935	Replication failure begins
125	124	DS Access	Directory Service Access	No	No	No	Success	4662	An operation was performed on an object - Success
126	125			No	No	No	Success	4661	A handle to an object was requeste - Success
127	126			Yes	No	No	Failure	4662	An operation was performed on an object - Failure
128	127			Yes	No	No	Failure	4661	A handle to an object was requeste - Failure
129	128	DS Access	Directory Service Changes	Yes	No	No	Success	5136	A directory service object was modified
130	129							5137	A directory service object was created
131	130							5138	A directory service object was undeleted
132	131							5139	A directory service object was moved
133	132							5141	A directory service object was deleted
134	133			No	No	No	Failure	-	-
135	134	DS Access	Directory Service Replication	No	No	No	Success	4932	Synchronization of a replica of an Active Directory naming context has begun
136	135			No	No	No	Success	4933	Synchronization of a replica of an Active Directory naming context has begun - Success
137	136			No	No	No	Failure	4933	Synchronization of a replica of an Active Directory naming context has begun - Failure
138	137	Logon/Logoff	Account Lockout	No	No	No	Success	-	-
139	138	Logon/Logoff	Account Lockout	Yes	Yes	Yes	Failure	4625	An account failed to log on
140	139	Logon/Logoff	User/Device Claims	Yes	Yes	Yes	Success	4626	User/Device claims information
141	140	Logon/Logoff	User/Device Claims	No	No	No	Failure	-	-
142	141	Logon/Logoff	IPsec Extended Mode	No	No	No	Success	4978	During Extended Mode negotiation, IPsec received an invalid negotiation packet. If this problem persists, it could indicate a network issue or an attempt to modify or replay this negotiation
143	142							4979	IPsec Main Mode and Extended Mode security associations were established
144	143							4980	IPsec Main Mode and Extended Mode security associations were established
145	144							4981	IPsec Main Mode and Extended Mode security associations were established
146	145							4982	IPsec Main Mode and Extended Mode security associations were established
147	146							4983	An IPsec Extended Mode negotiation failed. The corresponding Main Mode security association has been deleted
148	147							4984	An IPsec Extended Mode negotiation failed. The corresponding Main Mode security association has been deleted
149	148			No	No	No	Failure	-	-
150	149	Logon/Logoff	Group Membership	Yes	Yes	Yes	Success	4627	Group membership information
151	150	Logon/Logoff	Group Membership	No	No	No	Failure	-	-
152	151	Logon/Logoff	IPsec Main Mode	No	No	No	Success	4646	Security ID: %1
153	152							4650	An IPsec Main Mode security association was established. Extended Mode was not enabled. Certificate authentication was not used
154	153							4651	An IPsec Main Mode security association was established. Extended Mode was not enabled. A certificate was used for authentication
155	154							4655	An IPsec Main Mode security association ended
156	155							4976	During Main Mode negotiation, IPsec received an invalid negotiation packet. If this problem persists, it could indicate a network issue or an attempt to modify or replay this negotiation
157	156							5049	An IPsec Security Association was deleted
158	157							5453	An IPsec negotiation with a remote computer failed because the IKE and AuthIP IPsec Keying Modules (IKEEXT) service is not started
159	158			No	No	No	Failure	4652	An IPsec Main Mode negotiation failed
160	159			No	No	No	Failure	4653	An IPsec Main Mode negotiation failed
161	160	Logon/Logoff	IPsec Quick Mode	No	No	No	Success	4977	During Quick Mode negotiation, IPsec received an invalid negotiation packet. If this problem persists, it could indicate a network issue or an attempt to modify or replay this negotiation
162	161							5451	An IPsec Quick Mode security association was established
163	162							5452	An IPsec Quick Mode security association ended
164	163			No	No	No	Failure	-	-
165	164	Logon/Logoff	Logoff	Yes	Yes	Yes	Success	4634	An account was logged off
166	165			Yes	Yes	Yes	Success	4647	User initiated logoff
167	166			No	No	No	Failure	-	-
168	167	Logon/Logoff	Logon	Yes	Yes	Yes	Success	4624	An account was successfully logged on
169	168							4648	A logon was attempted using explicit credentials
170	169							4675	SIDs were filtered
171	170			Yes	Yes	Yes	Failure	4625	An account failed to log on
172	171	Logon/Logoff	Network Policy Server	No	No	No	-	6272	Network Policy Server granted access to a user
173	172							6273	Network Policy Server denied access to a user
174	173							6274	Network Policy Server discard the request for a user
175	174							6275	Network Policy Server discard the accounting request for a user
176	175							6276	Network Policy Server quarantined a user
177	176							6277	Network Policy Server granted access to a user but put it on probation because the host did not meet the defined health policy
178	177							6278	Network Policy Server granted full access to a user because the host met the defined health policy
179	178							6279	Network Policy Server locked the user account due to repeated failed authentication attempts
180	179							6280	Network Policy Server unlocked the user account
181	180	Logon/Logoff	Other Logon/Logoff Events	Yes	Yes	Yes	Success	4649	A replay attack was detected
182	181							4778	A session was reconnected to a Windows Station
183	182							4779	A session was disconnected from a Windows Station
184	183							4800	The workstation was locked
185	184							4801	The workstation was unlocked
186	185							4802	The screen saver was invoked
187	186							4803	The screen saver was dismissed
188	187							5632	A request was made to authenticate to a wireless network
189	188							5633	A request was made to authenticate to a wired network
190	189			Yes	Yes	Yes	Failure	5378	The requested credentials delegation was disallowed by policy
191	190	Logon/Logoff	Special Logon	Yes	Yes	Yes	Success	4964	Special groups have been assigned to a new logon
192	191			Yes	Yes	Yes	Success	4672	Special privileges assigned to new logon
193	192			No	No	No	Failure	-	-
194	193	Object Access	Application Generated	No	No	No	-	4665	An attempt was made to create an application client context
195	194							4666	An application attempted an operation
196	195							4667	An application client context was deleted
197	196							4668	An application was initialized
198	197	Object Access	Certification Services	No	No*	No	-	4868	The certificate manager denied a pending certificate request.	*Yes, If with Cert Server Role
199	198							4869	Certificate Services received a resubmitted certificate request.
200	199							4870	Certificate Services revoked a certificate.
201	200							4871	Certificate Services received a request to publish the certificate revocation list (CRL).
202	201							4872	Certificate Services published the certificate revocation list (CRL).
203	202							4873	A certificate request extension changed.
204	203							4874	One or more certificate request attributes changed.
205	204							4875	Certificate Services received a request to shut down.
206	205							4876	Certificate Services backup started.
207	206							4877	Certificate Services backup completed.
208	207							4878	Certificate Services restore started.
209	208							4879	Certificate Services restore completed.
210	209							4880	Certificate Services started.
211	210							4881	Certificate Services stopped.
212	211							4882	The security permissions for Certificate Services changed.
213	212							4883	Certificate Services retrieved an archived key.
214	213							4884	Certificate Services imported a certificate into its database.
215	214							4885	The audit filter for Certificate Services changed.
216	215							4886	Certificate Services received a certificate request.
217	216							4887	Certificate Services approved a certificate request and issued a certificate.
218	217							4888	Certificate Services denied a certificate request.
219	218							4889	Certificate Services set the status of a certificate request to pending.
220	219							4890	The certificate manager settings for Certificate Services changed.
221	220							4891	A configuration entry changed in Certificate Services.
222	221							4892	A property of Certificate Services changed.
223	222							4893	Certificate Services archived a key.
224	223							4894	Certificate Services imported and archived a key.
225	224							4895	Certificate Services published the CA certificate to Active Directory Domain Services.
226	225							4896	One or more rows have been deleted from the certificate database.
227	226							4897	Role separation enabled.
228	227							4898	Certificate Services loaded a template.
229	228	Object Access	Detailed File Share	No	Yes	Yes	Success	5145	A network share object was checked to see whether client can be granted desired access - Success
230	229	Object Access	Detailed File Share	Yes	Yes	Yes	Failure	5145	A network share object was checked to see whether client can be granted desired access - Failure
231	230	Object Access	File Share	Yes	Yes*	Yes	Success	5140	A network share object was accessed - Success	*Set No if a File Server
232	231							5142	A network share object was added
233	232							5143	A network share object was modified
234	233							5144	A network share object was deleted
235	234			Yes	Yes	Yes	Failure	5140	A network share object was accessed - Failure
236	235			Yes	Yes	Yes	Failure	5168	SPN check for SMB/SMB2 failed
237	236	Object Access	File System	No	No	No	Success	4656	A handle to an object was requested - Success
238	237							4658	The handle to an object was closed
239	238							4660	An object was deleted
240	239							4663	An attempt was made to access an object
241	240							4664	An attempt was made to create a hard link
242	241							4985	The state of a transaction has changed
243	242							4670	Permissions on an object were changed
244	243			No	No	No	Failure	4656	A handle to an object was requested - Failure
245	244			-	-	-	-	5051	A file was virtualized
246	245	Object Access	Filtering Platform Connection	No	No	No	Success	5154	The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.
247	246							5156	The Windows Filtering Platform has permitted a connection.
248	247							5158	The Windows Filtering Platform has permitted a bind to a local port.
249	248			Yes	Yes	Yes	Failure	5031	The Windows Firewall Service blocked an application from accepting incoming connections on the network.
250	249							5155	The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.
251	250							5157	The Windows Filtering Platform has blocked a connection.
252	251							5159	The Windows Filtering Platform has blocked a bind to a local port.
253	252			-	-	-	-	5150	The Windows Filtering Platform blocked a packet.
254	253			-	-	-	-	5151	A more restrictive Windows Filtering Platform filter has blocked a packet.
255	254	Object Access	Filtering Platform Packet Drop	No	No	No	Success	5153	A more restrictive Windows Filtering Platform filter has blocked a packet
256	255	Object Access	Filtering Platform Packet Drop	No	No	No	Failure	5152	The Windows Filtering Platform blocked a packet
257	256	Object Access	Handle Manipulation	No	No	No	Success	4658	The handle to an object was closed
258	257			No	No	No	Success	4690	An attempt was made to duplicate a handle to an object
259	258			No	No	No	Failure	-	-
260	259	Object Access	Kernel Object	No	No	No	Success	4656	A handle to an object was requested - Success
261	260							4658	The handle to an object was closed.
262	261							4660	An object was deleted.
263	262							4663	An attempt was made to access an object.
264	263			No	No	No	Failure	4656	A handle to an object was requested - Failure
265	264	Object Access	Other Object Access Events	Yes	Yes	Yes	Success	4691	Indirect access to an object was requested.
266	265							4698	A scheduled task was created.
267	266							4699	A scheduled task was deleted.
268	267							4700	A scheduled task was enabled.
269	268							4701	A scheduled task was disabled.
270	269							4702	A scheduled task was updated.
271	270							5888	An object in the COM+ Catalog was modified.
272	271							5889	An object was deleted from the COM+ Catalog.
273	272							5890	An object was added to the COM+ Catalog.
274	273			Yes	Yes	Yes	Failure	5148	The Windows Filtering Platform has detected a DoS attack and entered a defensive mode; packets associated with this attack will be discarded.
275	274			Yes	Yes	Yes	Failure	5149	The DoS attack has subsided and normal processing is being resumed.
276	275			-	-	-	-	4671	An application attempted to access a blocked ordinal through the TBS.
277	276	Object Access	Registry	No	No	No	Success	4663	An attempt was made to access an object.
278	277							4656	A handle to an object was requested.
279	278							4658	The handle to an object was closed.
280	279							4660	An object was deleted.
281	280							4657	A registry value was modified.
282	281							4670	Permissions on an object were changed.
283	282			No	No	No	Failure	4656	A handle to an object was requested.
284	283			-	-	-	-	5039	A registry key was virtualized.
285	284	Object Access	Removable Storage	Yes	Yes	Yes	Success	4656	A handle to an object was requested.
286	285							4658	The handle to an object was closed.
287	286							4663	An attempt was made to access an object.
288	287			Yes	Yes	Yes	Failure	4656	A handle to an object was requested.
289	288	Object Access	SAM	No	No	No	Success	4661	A handle to an object was requested
290	289	Object Access	SAM	No	No	No	Failure	4661	A handle to an object was requested
291	290	Object Access	Central Access Policy Staging	No	No	No	Success	4818	Proposed Central Access Policy does not grant the same access permissions as the current Central Access Policy
292	291	Object Access	Central Access Policy Staging	No	No	No	Failure	-	-
293	292	Policy Change	Audit Policy Change	Yes	Yes	Yes	Success	4715	The audit policy (SACL) on an object was changed.
294	293							4719	System audit policy was changed.
295	294							4817	Auditing settings on object were changed.
296	295							4902	The Per-user audit policy table was created.
297	296							4906	The CrashOnAuditFail value has changed.
298	297							4907	Auditing settings on object were changed.
299	298							4908	Special Groups Logon table modified.
300	299							4912	Per User Audit Policy was changed.
301	300							4904	An attempt was made to register a security event source.
302	301							4905	An attempt was made to unregister a security event source.
303	302			No	No	No	Failure	-	-
304	303	Policy Change	Authentication Policy Change	Yes	Yes	Yes	Success	4670	Permissions on an object were changed
305	304							4706	A new trust was created to a domain.
306	305							4707	A trust to a domain was removed.
307	306							4716	Trusted domain information was modified.
308	307							4713	Kerberos policy was changed.
309	308							4717	System security access was granted to an account.
310	309							4718	System security access was removed from an account.
311	310							4739	Domain Policy was changed.
312	311							4864	A namespace collision was detected.
313	312							4865	A trusted forest information entry was added.
314	313							4866	A trusted forest information entry was removed.
315	314							4867	A trusted forest information entry was modified.
316	315			No	No	No	Failure	-	-
317	316	Policy Change	Authorization Policy Change	No	No	No	Success	4703	A user right was adjusted.
318	317							4704	A user right was assigned.
319	318							4705	A user right was removed.
320	319							4670	Permissions on an object were changed.
321	320							4911	Resource attributes of the object were changed.
322	321							4913	Central Access Policy on the object was changed.
323	322			No	No	No	Failure	-	-
324	323	Policy Change	Filtering Platform Policy Change	No	No	No	Success	4709	IPsec Services was started.
325	324							4710	IPsec Services was disabled.
326	325							4711	May contain any one of the following:
327	326							5040	A change has been made to IPsec settings. An Authentication Set was added.
328	327							5041	A change has been made to IPsec settings. An Authentication Set was modified.
329	328							5042	A change has been made to IPsec settings. An Authentication Set was deleted.
330	329							5043	A change has been made to IPsec settings. A Connection Security Rule was added.
331	330							5044	A change has been made to IPsec settings. A Connection Security Rule was modified.
332	331							5045	A change has been made to IPsec settings. A Connection Security Rule was deleted.
333	332							5046	A change has been made to IPsec settings. A Crypto Set was added.
334	333							5047	A change has been made to IPsec settings. A Crypto Set was modified.
335	334							5048	A change has been made to IPsec settings. A Crypto Set was deleted.
336	335							5440	The following callout was present when the Windows Filtering Platform Base Filtering Engine started.
337	336							5441	The following filter was present when the Windows Filtering Platform Base Filtering Engine started.
338	337							5442	The following provider was present when the Windows Filtering Platform Base Filtering Engine started.
339	338							5443	The following provider context was present when the Windows Filtering Platform Base Filtering Engine started.
340	339							5444	The following sub-layer was present when the Windows Filtering Platform Base Filtering Engine started.
341	340							5446	A Windows Filtering Platform callout has been changed.
342	341							5448	A Windows Filtering Platform provider has been changed.
343	342							5449	A Windows Filtering Platform provider context has been changed.
344	343							5450	A Windows Filtering Platform sub-layer has been changed.
345	344							5456	PAStore Engine applied Active Directory storage IPsec policy on the computer.
346	345							5458	PAStore Engine applied locally cached copy of Active Directory storage IPsec policy on the computer.
347	346							5460	PAStore Engine applied local registry storage IPsec policy on the computer.
348	347							5463	PAStore Engine polled for changes to the active IPsec policy and detected no changes.
349	348							5464	PAStore Engine polled for changes to the active IPsec policy, detected changes, and applied them to IPsec Services.
350	349							5465	PAStore Engine received a control for forced reloading of IPsec policy and processed the control successfully.
351	350							5468	PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, found changes to the policy, and applied those changes. The cached copy of the Active Directory IPsec policy is no longer being used.
352	351							5471	PAStore Engine loaded local storage IPsec policy on the computer.
353	352							5473	PAStore Engine loaded directory storage IPsec policy on the computer.
354	353			No	No	No	Failure	4712	IPsec Services encountered a potentially serious failure.
355	354							5457	PAStore Engine failed to apply Active Directory storage IPsec policy on the computer.
356	355							5459	PAStore Engine failed to apply locally cached copy of Active Directory storage IPsec policy on the computer.
357	356							5461	PAStore Engine failed to apply local registry storage IPsec policy on the computer.
358	357							5462	PAStore Engine failed to apply some rules of the active IPsec policy on the computer. Use the IP Security Monitor snap-in to diagnose the problem.
359	358							5466	PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory cannot be reached, and will use the cached copy of the Active Directory IPsec policy instead. Any changes made to the Active Directory IPsec policy since the last poll could not be applied.
360	359							5467	PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, and found no changes to the policy. The cached copy of the Active Directory IPsec policy is no longer being used.
361	360							5472	PAStore Engine failed to load local storage IPsec policy on the computer.
362	361							5474	PAStore Engine failed to load directory storage IPsec policy on the computer.
363	362							5477	PAStore Engine failed to add quick mode filter.
364	363	Policy Change	MPSSVC Rule-Level Policy Change	Yes	Yes	Yes	Success	4944	The following policy was active when the Windows Firewall started.
365	364							4945	A rule was listed when the Windows Firewall started.
366	365							4946	A change has been made to Windows Firewall exception list. A rule was added.
367	366							4947	A change has been made to Windows Firewall exception list. A rule was modified.
368	367							4948	A change has been made to Windows Firewall exception list. A rule was deleted.
369	368							4949	Windows Firewall settings were restored to the default values.
370	369							4950	A Windows Firewall setting has changed.
371	370							4954	Windows Firewall Group Policy settings have changed. The new settings have been applied.
372	371							4956	Windows Firewall has changed the active profile.
373	372			Yes	Yes	Yes	Failure	4951	A rule has been ignored because its major version number was not recognized by Windows Firewall.
374	373							4952	Parts of a rule have been ignored because its minor version number was not recognized by Windows Firewall. The other parts of the rule will be enforced.
375	374							4953	A rule has been ignored by Windows Firewall because it could not parse the rule.
376	375							4957	Windows Firewall did not apply the following rule:
377	376							4958	Windows Firewall did not apply the following rule because the rule referred to items not configured on this computer:
378	377	Policy Change	Other Policy Change Events	No	No	No	Success	4714	Encrypted data recovery policy was changed.
379	378							4819	Central Access Policies on the machine have been changed.
380	379							4826	Boot Configuration Data loaded.
381	380							5063	A cryptographic provider operation was attempted - Success
382	381							5064	A cryptographic context operation was attempted - Success
383	382							5065	A cryptographic context modification was attempted - Success
384	383							5066	A cryptographic function operation was attempted - Success
385	384							5067	A cryptographic function modification was attempted - Success
386	385							5068	A cryptographic function provider operation was attempted - Success
387	386							5069	A cryptographic function property operation was attempted - Success
388	387							5070	A cryptographic function property modification was attempted - Success
389	388							5447	A Windows Filtering Platform filter has been changed.
390	389							6144	Security policy in the group policy objects has been applied successfully.
391	390			Yes	Yes	Yes	Failure	6145	One or more errors occurred while processing security policy in the group policy objects.
392	391							5063	A cryptographic provider operation was attempted - Failure
393	392							5064	A cryptographic context operation was attempted - Failure
394	393							5065	A cryptographic context modification was attempted - Failure
395	394							5066	A cryptographic function operation was attempted - Failure
396	395							5067	A cryptographic function modification was attempted - Failure
397	396							5068	A cryptographic function provider operation was attempted - Failure
398	397							5069	A cryptographic function property operation was attempted - Failure
399	398							5070	A cryptographic function property modification was attempted - Failure
400	399			-	-	-	-	4909	The local policy settings for the TBS were changed.
401	400			-	-	-	-	4910	The group policy settings for the TBS were changed.
402	401	Privilege Use	Non-Sensitive Privilege Use	No	No	No	Success	4673	A privileged service was called - Success
403	402							4674	An operation was attempted on a privileged object - Success
404	403							4985	The state of a transaction has changed.
405	404			No	No	No	Failure	4673	A privileged service was called - Failure
406	405			No	No	No	Failure	4674	An operation was attempted on a privileged object - Failure
407	406	Privilege Use	Sensitive Privilege Use	Yes	Yes	Yes	Success	4673	A privileged service was called - Success
408	407							4674	An operation was attempted on a privileged object - Success
409	408							4985	The state of a transaction has changed.
410	409			Yes	Yes	Yes	Failure	4673	A privileged service was called - Failure
411	410			Yes	Yes	Yes	Failure	4674	An operation was attempted on a privileged object - Failure
412	411	Privilege Use	Other Privilege Use Events	No	No	No	Success	4985	The state of a transaction has changed
413	412	Privilege Use	Other Privilege Use Events	No	No	No	Failure	-	-
414	413	System	IPsec Driver	No	No	No	Success	4960	IPsec dropped an inbound packet that failed an integrity check. If this problem persists, it could indicate a network issue or that packets are being modified in transit to this computer. Verify that the packets sent from the remote computer are the same as those received by this computer. This error might also indicate interoperability problems with other IPsec implementations.
415	414							4961	IPsec dropped an inbound packet that failed a replay check. If this problem persists, it could indicate a replay attack against this computer.
416	415							4962	IPsec dropped an inbound packet that failed a replay check. The inbound packet had too low a sequence number to ensure it was not a replay.
417	416							4963	IPsec dropped an inbound clear text packet that should have been secured. This is usually due to the remote computer changing its IPsec policy without informing this computer. This could also be a spoofing attack attempt.
418	417							4965	IPsec received a packet from a remote computer with an incorrect Security Parameter Index (SPI). This is usually caused by malfunctioning hardware that is corrupting packets. If these errors persist, verify that the packets sent from the remote computer are the same as those received by this computer. This error may also indicate interoperability problems with other IPsec implementations. In that case, if connectivity is not impeded, then these events can be ignored.
419	418							5478	IPsec Services has started successfully.
420	419							5479	IPsec Services has been shut down successfully. The shutdown of IPsec Services can put the computer at greater risk of network attack or expose the computer to potential security risks.
421	420			No	No	No	Failure	5480	IPsec Services failed to get the complete list of network interfaces on the computer. This poses a potential security risk because some of the network interfaces may not get the protection provided by the applied IPsec filters. Use the IP Security Monitor snap-in to diagnose the problem.
422	421							5483	IPsec Services failed to initialize RPC server. IPsec Services could not be started.
423	422							5484	IPsec Services has experienced a critical failure and has been shut down. The shutdown of IPsec Services can put the computer at greater risk of network attack or expose the computer to potential security risks.
424	423							5485	IPsec Services failed to process some IPsec filters on a plug-and-play event for network interfaces. This poses a potential security risk because some of the network interfaces may not get the protection provided by the applied IPsec filters. Use the IP Security Monitor snap-in to diagnose the problem.
425	424	System	Other System Events	Yes	Yes	Yes	Success	5024	The Windows Firewall Service has started successfully.
426	425							5025	The Windows Firewall Service has been stopped.
427	426							5033	The Windows Firewall Driver has started successfully.
428	427							5034	The Windows Firewall Driver was stopped.
429	428							5058	Key file operation - Success
430	429							5059	Key migration operation - Success
431	430			Yes	Yes	Yes	Failure	5027	The Windows Firewall Service was unable to retrieve the security policy from the local storage. The service will continue enforcing the current policy.
432	431							5028	The Windows Firewall Service was unable to parse the new security policy. The service will continue with currently enforced policy.
433	432							5029	The Windows Firewall Service failed to initialize the driver. The service will continue to enforce the current policy.
434	433							5030	The Windows Firewall Service failed to start.
435	434							5032	Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network.
436	435							5035	The Windows Firewall Driver failed to start.
437	436							5037	The Windows Firewall Driver detected critical runtime error. Terminating.
438	437							5058	Key file operation - Failure
439	438							5059	Key migration operation - Failure
440	439			-	-	-	-	6400	Received an incorrectly formatted response while discovering availability of content.
441	440							6401	Received invalid data from a peer. Data discarded.
442	441							6402	The message to the hosted cache offering it data is incorrectly formatted.
443	442							6403	The hosted cache sent an incorrectly formatted response to the client.
444	443							6404	Hosted cache could not be authenticated using the provisioned SSL certificate.
445	444							6405	%2 instance(s) of event id %1 occurred.
446	445							6406	%1 registered to Windows Firewall to control filtering for the following: %2
447	446							6407	1%
448	447							6408	Registered product %1 failed and Windows Firewall is now controlling the filtering for %2
449	448							6409	A service connection point object could not be parsed.
450	449	System	Security State Change	Yes	Yes	Yes	Success	4608	Windows is starting up.
451	450							4616	The system time was changed.
452	451							4621	Administrator recovered system from CrashOnAuditFail
453	452			No	No	No	Failure	-	-
454	453	System	Security System Extension	Yes	Yes	Yes	Success	4610	An authentication package has been loaded by the Local Security Authority.
455	454							4611	A trusted logon process has been registered with the Local Security Authority.
456	455							4614	A notification package has been loaded by the Security Account Manager.
457	456							4622	A security package has been loaded by the Local Security Authority.
458	457							4697	A service was installed in the system.
459	458			No	No	No	Failure	-	-
460	459	System	System Integrity	Yes	Yes	Yes	Success	4612	Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits.
461	460							4615	Invalid use of LPC port.
462	461							4618	A monitored security event pattern has occurred.
463	462							4816	RPC detected an integrity violation while decrypting an incoming message.
464	463							5056	A cryptographic self-test was performed.
465	464							5062	A kernel-mode cryptographic self-test was performed.
466	465							5061	Cryptographic operation - Success
467	466			Yes	Yes	Yes	Failure	5038	Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.
468	467							5057	A cryptographic primitive operation failed.
469	468							5060	Verification operation failed.
470	469							5061	Cryptographic operation - Failure
471	470							6281	Code Integrity determined that the page hashes of an image file are not valid. The file could be improperly signed without page hashes or corrupt due to unauthorized modification. The invalid hashes could indicate a potential disk device error.
472	471							6410	Code integrity determined that a file does not meet the security requirements to load into a process.
473	472	Global Object Access Auditing	File System	-	-	-	-	-	-
474	473	Global Object Access Auditing	Registry	-	-	-	-	-	-
475
476
477		Legend	DC = Domain Controller	Recommends Yes/No: Should the audit policy be applied
478			Svr = Domain Server
479			WS = Domain Workstation
480
481		References / Further reading
482		MS Security auditing		https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/security-auditing-overview
483		MS Advacnced security audit policies		https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/advanced-security-auditing
484		MS Advanced security audit policy settings		https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings
485		MS Advanced secuirty auditing FAQ		https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/advanced-security-auditing-faq