A list of interesting Windows XP and Server 2003 security events.

Source	Type	ID	Explanation
Security	Notice	631	Creation of a global group
Security	Notice	634	Deletion of a global group
Security	Notice	632	Addition of a user to a global group
Security	Notice	633	Deletion of a user from a global group
Security	Error	627	Password change failures
Security	Notice	627	Password change successes
Security	Notice	642	Changes to a user profile
Security	Notice	624	Creation of a user
Security	Notice	630	Deletion of a user
Security	Notice	644	Locking of a user account after a number of failed passwords
Security	Error	672	Logons with expired accounts
Security	Error	675	Failed logons (either wrong username or wrong password)
Security	Notice	612	Audit policy changes
Security	Notice	643	Policy changes
Security	Notice	608	User rights assignments
Security	Notice	609	User rights removal
Security	Notice	517	Clearing of the audit logs
Security	Notice	513	Windows machine shutting down
Security	Notice	512	Windows machine starting up