Windows Event ID reference

Q: Which Windows event IDs matter most for security?

A good starting set is 4624 and 4625 (logons), 4688 (process creation with command lines), 4720, 4728, 4732 and 4756 (accounts and admin groups), 4698 and 7045 (scheduled tasks and services), 1102 (Security log cleared), 4768, 4769 and 4771 (Kerberos), and 4104 (PowerShell script blocks).

Q: Where do I find these events?

In Event Viewer under Windows Logs (Security, System) or Applications and Services Logs for the others, such as Microsoft-Windows-PowerShell/Operational or Microsoft-Windows-Sysmon/Operational. In PowerShell, Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} returns them.

What each Windows security event means, why it matters, what to check and how to turn it on: logons, Kerberos, account changes, services, scheduled tasks, PowerShell, Defender, RDP and Sysmon, with ATT&CK mappings.

Runs in your browser. Nothing you paste is uploaded, stored or logged.

Filter by event ID or keywordLog

82 of 82 events

Event ID	What it records	Log	Category
1102	The audit log was cleared	Security	Defense evasion
4616	The system time was changed	Security	Defense evasion
4624	An account was successfully logged on	Security	Logon
4625	An account failed to log on	Security	Logon
4634	An account was logged off	Security	Logon
4647	User initiated logoff	Security	Logon
4648	A logon was attempted using explicit credentials	Security	Logon
4657	A registry value was modified	Security	Object access
4662	An operation was performed on an object	Security	Active Directory
4663	An attempt was made to access an object	Security	Object access
4672	Special privileges assigned to new logon	Security	Logon
4688	A new process has been created	Security	Process
4689	A process has exited	Security	Process
4697	A service was installed in the system	Security	Persistence
4698	A scheduled task was created	Security	Persistence
4699	A scheduled task was deleted	Security	Persistence
4702	A scheduled task was updated	Security	Persistence
4719	System audit policy was changed	Security	Defense evasion
4720	A user account was created	Security	Account management
4722	A user account was enabled	Security	Account management
4723	An attempt was made to change an account's password	Security	Account management
4724	An attempt was made to reset an account's password	Security	Account management
4725	A user account was disabled	Security	Account management
4726	A user account was deleted	Security	Account management
4728	A member was added to a security-enabled global group	Security	Group management
4732	A member was added to a security-enabled local group	Security	Group management
4738	A user account was changed	Security	Account management
4740	A user account was locked out	Security	Account management
4741	A computer account was created	Security	Account management
4742	A computer account was changed	Security	Account management
4756	A member was added to a security-enabled universal group	Security	Group management
4767	A user account was unlocked	Security	Account management
4768	A Kerberos authentication ticket (TGT) was requested	Security	Kerberos
4769	A Kerberos service ticket was requested	Security	Kerberos
4770	A Kerberos service ticket was renewed	Security	Kerberos
4771	Kerberos pre-authentication failed	Security	Kerberos
4776	The computer attempted to validate the credentials for an account	Security	Credential validation
4778	A session was reconnected to a Window Station	Security	Logon
4779	A session was disconnected from a Window Station	Security	Logon
4798	A user's local group membership was enumerated	Security	Discovery
4799	A security-enabled local group membership was enumerated	Security	Discovery
4800	The workstation was locked	Security	Logon
4801	The workstation was unlocked	Security	Logon
4887	Certificate Services approved a certificate request and issued a certificate	Security	Active Directory
4946	A rule was added to the Windows Firewall exception list	Security	Defense evasion
4964	Special groups have been assigned to a new logon	Security	Logon
5136	A directory service object was modified	Security	Active Directory
5140	A network share object was accessed	Security	Network share
5145	A network share object was checked for access	Security	Network share
5156	The Windows Filtering Platform has permitted a connection	Security	Network
6416	A new external device was recognized by the system	Security	Device
41	The system has rebooted without cleanly shutting down first	System	System
104	An event log was cleared	System	Defense evasion
1074	A process initiated a restart or shutdown	System	System
6005	The event log service was started	System	System
6006	The event log service was stopped	System	System
6008	The previous system shutdown was unexpected	System	System
7036	A service entered the running or stopped state	System	Service
7040	The start type of a service was changed	System	Defense evasion
7045	A service was installed in the system	System	Persistence
4103	Executing pipeline (module logging)	PowerShell	Execution
4104	Creating Scriptblock text (script block logging)	PowerShell	Execution
1116	The antimalware platform detected malware or other potentially unwanted software	Defender	Detection
1117	The antimalware platform performed an action to protect your system	Defender	Detection
5001	Real-time protection is disabled	Defender	Defense evasion
5007	The antimalware platform configuration changed	Defender	Defense evasion
21	Remote Desktop Services: Session logon succeeded	Remote Desktop	Remote Desktop
24	Remote Desktop Services: Session has been disconnected	Remote Desktop	Remote Desktop
25	Remote Desktop Services: Session reconnection succeeded	Remote Desktop	Remote Desktop
1149	Remote Desktop Services: User authentication succeeded	Remote Desktop	Remote Desktop
106	Task registered	Task Scheduler	Persistence
200	Action started	Task Scheduler	Execution
5861	WMI permanent event consumer registered	WMI	Persistence
59	BITS started a transfer job	BITS	Command and control
1	Process creation	Sysmon	Process
3	Network connection	Sysmon	Network
7	Image loaded	Sysmon	Process
8	CreateRemoteThread	Sysmon	Process injection
10	Process accessed	Sysmon	Credential access
11	File created	Sysmon	File
13	Registry value set	Sysmon	Registry
22	DNS query	Sysmon	Network

How it works

Each of the 82 events here has its own page: what Windows records, why it matters to defenders, which fields to check when triaging it, how to turn it on, and the MITRE ATT&CK techniques it helps detect.

It covers the Security and System logs, PowerShell, Microsoft Defender, Remote Desktop, Task Scheduler, WMI, BITS and Sysmon. Logon types, failure codes and Kerberos codes are explained on the events that use them.

Questions

Which Windows event IDs matter most for security?

A good starting set: 4624 and 4625 (logons), 4688 (process creation with command lines), 4720, 4728, 4732 and 4756 (new accounts and admin groups), 4698 and 7045 (scheduled tasks and services), 1102 (Security log cleared), 4768, 4769 and 4771 (Kerberos) and 4104 (PowerShell script blocks).

Why don't I see some of these events?

Many are only written when the matching audit policy is turned on, and some need extra settings such as command-line logging, an audit rule (SACL) on the object, or Sysmon installed. Each event page says how to turn it on.

Where do I find these events?

In Event Viewer under Windows Logs (Security, System), or under Applications and Services Logs for the others, such as Microsoft-Windows-PowerShell/Operational. In PowerShell: Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625}

Why are Sysmon events listed separately?

Sysmon numbers its events from 1 upwards, which overlap with numbers used by other logs, so their pages have a “sysmon-” prefix in the address. The same goes for Defender, Remote Desktop, Task Scheduler, WMI and BITS events.