Scribd Logo
Upload

Welcome to Scribd!

  • Secy Logs

    Uploaded by

    AlephNull
    133 views1 page
    This document provides a quick reference to Windows security log event IDs related to user and group account changes, domain controller authentication, logon sessions, and Kerberos and logon failure codes. It lists the event IDs for actions like creating, enabling, disabling, or changing accounts, passwords, groups, and logon sessions. It also includes explanations of some common Kerberos and logon failure codes to help understand logon failures.

    Original Description:

    Security

    Original Title

    SecyLogs

    Copyright

    © Attribution Non-Commercial (BY-NC)

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Report this Document
    This document provides a quick reference to Windows security log event IDs related to user and group account changes, domain controller authentication, logon sessions, and Kerberos and logon failure codes. It lists the event IDs for actions like creating, enabling, disabling, or changing accounts, passwords, groups, and logon sessions. It also includes explanations of some common Kerberos and logon failure codes to help understand logon failures.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd
    Flag for inappropriate content
    Download as pdf or txt
    133 views1 page

    Secy Logs

    Uploaded by

    AlephNull
    This document provides a quick reference to Windows security log event IDs related to user and group account changes, domain controller authentication, logon sessions, and Kerberos and logon failure codes. It lists the event IDs for actions like creating, enabling, disabling, or changing accounts, passwords, groups, and logon sessions. It also includes explanations of some common Kerberos and logon failure codes to help understand logon failures.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd
    Flag for inappropriate content
    Download as pdf or txt
    of 1

    Windows Security Log Quick Reference

    User Account Changes


    4720 4722 4723 4724 4725 4726 4738 4740 4767 4781 Created Enabled User changed own password Privileged User changed this users password Disabled Deleted Changed Locked out Unlocked Name change 4772 4771 Kerberos preauthentication failed A Kerberos authentication ticket requested failed 4768

    Domain Controller Authentication Events


    A Kerberos authentication ticket (TGT) was requested

    See Kerberos Failure Codes

    Group Changes
    Local

    Created
    4731 4727 4754 4744 4749 4759

    Changed
    4737 4735 4755 4745 4750 4760

    Deleted
    4734 4730 4758 4748 4753 4763

    Member Added
    4732 4728 4756 4746 4751 4761

    Removed
    4733 4729 4757 4747 4752 4762

    Security Global
    Universal Local

    Distribution Global
    Universal

    Logon Session Events


    4624 4647 4625 4778 4779 4800 4801 4802 4803 Successful logon User initiated logoff Correlate by Logon ID 0x6 0x7 0x9 0xC 0x12 0x17 0x18 0x20 0x25

    Kerberos Failure Codes


    Bad user name New computer account? Administrator should reset password Workstation restriction Account disabled, expired, locked out, logon hours restriction The users password has expired Bad password Frequently logged by computer accounts Workstations clock too far out of sync with the DCs

    Logon failure (See Logon Failure Codes) Remote desktop session reconnected Remote desktop session disconnected Workstation locked Workstation unlocked Screen saver invoked Screen saver dismissed

    Logon Types
    2 3 4 5 7 8 10 11 Interactive Network (i.e. mapped drive) Batch (i.e. schedule task) Service (service startup) Unlock (i.e. unnattended workstation with password protected screen saver) Network Cleartext (Most often indicates a logon to IIS with basic authentication) Remote Desktop Logon with cached credentials
    TM

    Logon Failure Codes


    0xC0000064 0xC000006A 0xC0000234 0xC0000072 User name does not exist User name is correct but the password is wrong User is currently locked out

    Account is currently disabled User tried to logon outside his day of 0xC000006F week or time of day restrictions 0xC0000070 Workstation restriction 0xC00000193 Account expiration 0xC0000071 0xC0000133 0xC0000224 0xC0000225 0xC000015b Expired password
    Clocks between DC and other computer too far out of sync

    User is required to change password at next logon Evidently a bug in Windows and not a risk The user has not been granted the requested logon type (aka logon right) at this machine

    Bridge the Gap Between Application and SIEM

    You might also like