Windows Security Event IDs
Provider: Microsoft-Windows-Security-Auditing · channel: Security
Need exact lookup across Windows, Sysmon, Defender, PowerShell, and System providers? Use the Event and Activity Reference.
Authentication and Kerberos
| ID |
Meaning |
Pivot next |
| 4624 |
Successful logon |
Logon type, source, account, follow-on actions |
| 4625 |
Failed logon |
Failure reason, source, target spread, later success |
| 4634 |
Logoff |
Pair with session/logon ID |
| 4647 |
User-initiated logoff |
Session timeline |
| 4648 |
Explicit credentials |
Calling process, target server, account mismatch |
| 4672 |
Special privileges assigned |
Privileged actions in same logon session |
| 4776 |
NTLM credential validation |
Workstation/source and NTLM use |
| 4768 |
Kerberos TGT requested |
Client, pre-auth type, encryption, result |
| 4769 |
Kerberos service ticket requested |
SPN, requester, volume, encryption |
| 4770 |
Kerberos ticket renewed |
Session continuity |
| 4771 |
Kerberos pre-auth failed |
Failure code, source, account spread |
Account and group changes
| IDs |
Meaning |
| 4720 / 4722 / 4725 / 4726 |
Account created, enabled, disabled, deleted |
| 4723 / 4724 |
Password change/reset attempted |
| 4738 |
Account changed |
| 4728 / 4729 |
Member added to/removed from global group |
| 4732 / 4733 |
Member added to/removed from local group |
| 4756 / 4757 |
Member added to/removed from universal group |
Pivot next: actor logon ID, target account age, privileged group, originating host, and activity immediately afterward.
Process, task, service, and audit changes
| ID |
Meaning |
| 4688 / 4689 |
Process created/exited |
| 4656 / 4663 |
Object handle requested/object accessed |
| 4698 / 4699 |
Scheduled task created/deleted |
| 4700 / 4701 / 4702 |
Scheduled task enabled/disabled/updated |
| 4697 |
Service installed in Security log |
| 7045 |
Service installed in System log |
| 4719 |
Audit policy changed |
| 1102 |
Audit log cleared |
Logon types
| Type |
Meaning |
Common use |
| 2 |
Interactive |
Local console |
| 3 |
Network |
SMB and remote resource access |
| 4 |
Batch |
Scheduled/batch job |
| 5 |
Service |
Service startup |
| 7 |
Unlock |
Workstation unlock |
| 8 |
NetworkCleartext |
Credentials passed in clear form to auth package |
| 9 |
NewCredentials |
RunAs /netonly style |
| 10 |
RemoteInteractive |
RDP/Terminal Services |
| 11 |
CachedInteractive |
Cached domain credentials |
High-value memory
4624 success · 4625 failure · 4688 process · 4672 privilege
4768 TGT · 4769 service ticket · 4720 new account
4728/4732/4756 group add · 4698 task · 4697/7045 service · 1102 cleared log