Windows event IDs

4624: successful sign-in

4624 · Security log · session type (Logon Type)

An account signed in. The type tells how: 2 interactive, 3 network, 4 batch, 5 service, 7 unlock, 10 remote desktop (RDP), 11 cached credentials.

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=(Get-Date).AddHours(-24)} | Select -First 20 TimeCreated,@{n='Compte';e={$_.Properties[5].Value}},@{n='Type';e={$_.Properties[8].Value}}

4625: failed sign-in

4625 · Security log · sub status (Sub Status)

A sign-in attempt failed. The sub status gives the cause: 0xC000006A wrong password, 0xC0000064 account does not exist, 0xC0000234 account locked, 0xC0000072 account disabled, 0xC000006F outside allowed hours.

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddHours(-6)} | Select TimeCreated,@{n='Compte';e={$_.Properties[5].Value}},@{n='IP source';e={$_.Properties[19].Value}}

4634 / 4647: sign-out

4634 (logoff) · 4647 (user-initiated logoff)

End of a session. Match the session ID (Logon ID) with the one from 4624 to compute the duration.

4648: sign-in with explicit credentials

4648 · Security log

A session used credentials other than the user's own (runas, scheduled task, drive mapping).

4768 / 4769 / 4771: Kerberos

4768 (TGT request) · 4769 (service ticket) · 4771 (pre-authentication failed)

Kerberos events on domain controllers. 4771 with code 0x18 signals a wrong password.

4776: NTLM validation

4776 · Security log (domain controllers)

The domain controller validated credentials through NTLM. Error code 0xC000006A means wrong password.

4740: account lockout

4740 · Security log (PDC domain controller)

An account was locked out. The 'Caller Computer Name' field names the machine that caused the wrong passwords.

Get-WinEvent -ComputerName (Get-ADDomain).PDCEmulator -FilterHashtable @{LogName='Security'; Id=4740} | Select TimeCreated,@{n='Compte';e={$_.Properties[0].Value}},@{n='Machine';e={$_.Properties[1].Value}}

4720 / 4722 / 4725 / 4726: account lifecycle

4720 created · 4722 enabled · 4725 disabled · 4726 deleted

Creation, enabling, disabling and deletion of a user account.

4723 / 4724: password change or reset

4723 (changed by the user) · 4724 (reset by an administrator)

A password was changed or reset.

4728 / 4732 / 4756: added to a group

4728 (global security group) · 4732 (local group) · 4756 (universal group)

A member was added to a security group. Watch above all Administrators, Domain Admins and Enterprise Admins.

4672: special privileges assigned

4672 · Security log

A session received sensitive privileges (for example SeDebugPrivilege). Normal for administrator accounts and SYSTEM.

4688: process creation

4688 · Security log

A process started. With the 'Include command line' option, the event contains the arguments.

1102: audit log cleared

1102 · Security log (104 for other logs)

The security log was cleared. This event is always recorded, even if auditing is off.

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=1102} | Select TimeCreated,Message

4719: audit policy changed

4719 · Security log

The system audit policy changed.

4697 / 7045: service installed

4697 (Security) · 7045 (System, Service Control Manager)

A new service was installed. Malware and remote execution tools (PsExec) create them.

Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045} | Select TimeCreated,@{n='Service';e={$_.Properties[0].Value}},@{n='Chemin';e={$_.Properties[1].Value}}

7034 / 7036 / 7031: service state

7036 (started/stopped) · 7034 (unexpected stop) · 7031 (unexpected stop with recovery action)

Service state changes and crashes.

Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Service Control Manager'; Id=7034,7031} -MaxEvents 20

4698 / 4702: scheduled task created or changed

4698 (created) · 4699 (deleted) · 4702 (changed)

Creation and modification of scheduled tasks, a common persistence technique.

41 (Kernel-Power): restart without a clean shutdown

41 · System log · Kernel-Power

The system restarted without shutting down cleanly (power loss, crash, freeze).

Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-Kernel-Power'; Id=41} -MaxEvents 10 | Select TimeCreated,Message

6005 / 6006 / 6008: log start and stop

6005 (start) · 6006 (clean stop) · 6008 (unexpected stop)

Start and stop markers of the Event Log service, useful to reconstruct availability.

Get-WinEvent -FilterHashtable @{LogName='System'; Id=6005,6006,6008} -MaxEvents 20 | Select TimeCreated,Id

1074: shutdown or restart initiated

1074 · System log · User32

Shows which process or user requested the shutdown or restart, and the reason.

Get-WinEvent -FilterHashtable @{LogName='System'; Id=1074} -MaxEvents 10 | Select TimeCreated,Message

1000 / 1001: application crash

1000 (Application Error) · 1001 (Windows Error Reporting)

An application stopped abruptly; the faulting module is shown in the message.

Get-WinEvent -FilterHashtable @{LogName='Application'; Id=1000} -MaxEvents 10 | Select TimeCreated,Message

55 / 98 (Ntfs) · 7 (disk): disk errors

55 (Ntfs: corrupt structure) · 7 and 11 (disk: bad block, controller error)

File system or disk errors. Disk events 7, 11 or 51 often announce a disk at end of life.

Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='disk','Ntfs'} -MaxEvents 20 | Select TimeCreated,ProviderName,Id,Message

0xC000006D · 0xC000006A · 0xC0000064: sign-in status codes

0xC000006D (generic failure) · 0xC000006A (wrong password) · 0xC0000064 (unknown user)

Status and sub status codes of a 4625 event. 0xC000006D gives the status; the sub status gives the reason.

0xC0000234 · 0xC0000072 · 0xC0000193: account locked, disabled, expired

0xC0000234 (locked) · 0xC0000072 (disabled) · 0xC0000193 (expired)

Common sub statuses of a failed sign-in that explain why a user cannot get in.

Blue screen codes: 0x0000007E · 0x00000050 · 0x0000009F

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED · PAGE_FAULT_IN_NONPAGED_AREA · DRIVER_POWER_STATE_FAILURE

Frequent stops: 0x7E often points to a driver, 0x50 to memory or a driver, 0x9F to a driver's power management.

Get-ChildItem C:\Windows\Minidump | Sort LastWriteTime -Descending | Select -First 3
Get-WinEvent -FilterHashtable @{LogName='System'; Id=1001} -MaxEvents 5 | Select Message