Interesting Windows XP and Server 2003 event logs

A list of interesting Windows XP and Server 2003 security events.
SourceTypeIDExplanation
SecurityNotice631Creation of a global group
SecurityNotice634Deletion of a global group
SecurityNotice632Addition of a user to a global group
SecurityNotice633Deletion of a user from a global group
SecurityError627Password change failures
SecurityNotice627Password change successes
SecurityNotice642Changes to a user profile
SecurityNotice624Creation of a user
SecurityNotice630Deletion of a user
SecurityNotice644Locking of a user account after a number of failed passwords
SecurityError672Logons with expired accounts
SecurityError675Failed logons (either wrong username or wrong password)
SecurityNotice612Audit policy changes
SecurityNotice643Policy changes
SecurityNotice608User rights assignments
SecurityNotice609User rights removal
SecurityNotice517Clearing of the audit logs
SecurityNotice513Windows machine shutting down
SecurityNotice512Windows machine starting up

Tags: 

Share