User Account Changes

4720 ⇒ Created
4722 ⇒ Enabled
4723 ⇒ User changed own password
4724 ⇒ Privileged User changed this user’s password
4725 ⇒ Disabled
4726 ⇒ Deleted
4738 ⇒ Changed
4740 ⇒ Locked out
4767 ⇒ Unlocked
4781 ⇒ Name change

Domain Controller Authentication Events

4768 ⇒ A Kerberos authentication ticket (TGT) was requested
4771 ⇒ Kerberos pre-authentication failed
4820 ⇒ A Kerberos TGT was denied because the device does not meet the access control restrictions

Kerberos Failure Codes

0x6 ⇒ Bad user name
0x7 ⇒ New computer account
0x9 ⇒ Administrator should reset password
0xC ⇒ Workstation restriction
0x12 ⇒ Account disabled, expired, locked out, logon hours restriction
0x17 ⇒ The users password has expired
0x18 ⇒ Bad password
0x20 ⇒ Frequently logged by computer accounts
0x25 ⇒ Workstation´s clock too far out of sync with the DC´s

Logon Types

2 ⇒ Interactive
3 ⇒ Network (i.e. mapped drive)
4 ⇒ Batch (i.e. schedule task)
5 ⇒ Service (service startup)
7 ⇒ Unlock
8 ⇒ Network Cleartext
10 ⇒ Remote Desktop
11 ⇒ Logon with cached credentials

Logon Session Events

4624 ⇒ Successful Logon
4647 ⇒ User initiated logoff
4625 ⇒ Logon failure
4778 ⇒ Remote Desktop session reconnected
4779 ⇒ Remote Desktop session disconnected
4800 ⇒ Workstation locked
4801 ⇒ Workstation unlocked
4802 ⇒ Screen saver invoked
4803 ⇒ Screen saver dismissed

Logon Failure Codes

0xC0000064 ⇒  User name does not exist
0xC000006A ⇒  User name is correct but the password is wrong
0xC0000234 ⇒  User is currently locked out
0xC0000072 ⇒  Account is currently disabled
0xC000006F ⇒  User tried to logon outside his day of week or time of day restriction
0xC0000070 ⇒  Workstation restriction
0xC0000193 ⇒  Account expiration
0xC0000071 ⇒  Expired password
0xC0000133 ⇒  Clocks between DC and other computer too far out of sync
0xC0000224 ⇒  User is required to change password at next logon
0xC0000225 ⇒  Evidently a bug in Windows
0xC000015b ⇒  The user hat not been granted the requested logon type at this machine

Security Group Changes

Local Group

Created ⇒ 4731
Changed ⇒ 4735
Deleted ⇒ 4734
Member Added ⇒ 4732
Member Removed ⇒ 4733

Global Group

Created ⇒ 4727
Changed ⇒ 4737
Deleted ⇒ 4730
Member Added ⇒ 4728
Member Removed ⇒ 4729

Universal Group

Created ⇒ 4754
Changed ⇒ 4755
Deleted ⇒ 4758
Member Added ⇒ 4756
Member Removed ⇒ 4757

Distribution Group Changes

Local Group

Created ⇒ 4744
Changed ⇒ 4745
Deleted ⇒ 4748
Member Added ⇒ 4746
Member Removed ⇒ 4747

Global Group

Created ⇒ 4749
Changed ⇒ 4750
Deleted ⇒ 4753
Member Added ⇒ 4751
Member Removed ⇒ 4752

Universal Group

Created ⇒ 4759
Changed ⇒ 4760
Deleted ⇒ 4763
Member Added ⇒ 4761
Member Removed ⇒ 4762