Windows Logging Recommendations

Windows Event Log Recommendations By Log Source

 
​
Category 
Name 
ID 
Level 
Event Log 
Event Source 
1 
Boot Events 
Shutdown Initiate Failed 
1074 
Warning 
User32 
User32 
2 
Application Crashes 
BSOD 
1001 
Error 
System 
Microsoft-Windows-WER-SystemErrorReporting 
3 
Boot Events 
Windows Shutdown 
13 
Information 
System 
Microsoft-Windows-Kernel-General 
4 
Boot Events 
Windows Startup 
12 
Information 
System 
Microsoft-Windows-Kernel-General 
5 
Clearing Event Logs 
Event Log was Cleared 
104 
Information 
System 
Microsoft-Windows-Eventlog 
6 
Group Policy Errors 
Generic Internal Error 
1126 
Error 
System 
Microsoft-Windows-GroupPolicy 
7 
Group Policy Errors 
Group Policy Application Failed due to Connectivity 
1129 
Error 
System 
Microsoft-Windows-GroupPolicy 
8 
Group Policy Errors 
Internal Error 
1125 
Error 
System 
Microsoft-Windows-GroupPolicy 
9 
Kernel Driver Signing 
Failed Kernel Driver Loading 
219 
Warning 
System 
Microsoft-Windows-Kernel-PnP 
10 
Software and Service Installation 
New Kernel Filter Driver 
6 
Information 
System 
Microsoft-Windows-FilterManager 
11 
Software and Service Installation 
New Windows Service 
7045 
Information 
System 
Microsoft-Windows-FilterManager 
12 
Software and Service Installation 
Service Start Failure 
7000 
Error 
System 
Service Control Manager 
13 
Software and Service Installation 
Windows Update Installed 
19 
Information 
System 
Microsoft-Windows-WindowsUpdateClient 
14 
System Integrity 
System Time Changed 
1 
Information 
System 
Microsoft-Windows-Kernel-General 
15 
System or Service Failures 
Windows Service Fails or Crashes 
7022, 7023, 7024, 7026, 7031, 7032, 7034 
Error 
System 
Service Control Manager 
16 
Software and Service Installation 
Update Packages Installed 
2 
Information 
Setup 
Microsoft-Windows-Servicing 
17 
Windows Update Errors 
Hotpatching Failed 
1009 
Information 
Setup 
Microsoft-Windows-Servicing 
18 
Account Usage 
Account Lockouts 
4740 
Information 
Security 
Microsoft-Windows-Security-Auditing 
19 
Account Usage 
Account Login with Explicit Credentials 
4648 
Information 
Security 
Microsoft-Windows-Security-Auditing 
20 
Account Usage 
Account Name Changed 
4781 
Information 
Security 
Microsoft-Windows-Security-Auditing 
21 
Account Usage 
Account removed from Local Sec. Grp. 
4733 
Information 
Security 
Microsoft-Windows-Security-Auditing 
22 
Account Usage 
Credential Authentication 
4776 
Information 
Security 
Microsoft-Windows-Security-Auditing 
23 
Account Usage 
Credentials backed up 
5376 
Information 
Security 
Microsoft-Windows-Security-Auditing 
24 
Account Usage 
Credentials restored 
5377 
Information 
Security 
Microsoft-Windows-Security-Auditing 
25 
Account Usage 
Failed User Account Login 
4625 
Information 
Security 
Microsoft-Windows-Security-Auditing 
26 
Account Usage 
Logoff Event 
4634 
Information 
Security 
Microsoft-Windows-Security-Auditing 
27 
Account Usage 
Logon with Special Privs 
4672 
Information 
Security 
Microsoft-Windows-Security-Auditing 
28 
Account Usage 
New User Account Created 
4720 
Information 
Security 
Microsoft-Windows-Security-Auditing 
29 
Account Usage 
New User Account Enabled 
4722 
Information 
Security 
Microsoft-Windows-Security-Auditing 
30 
Account Usage 
Password Hash Accessed 
4782 
Information 
Security 
Microsoft-Windows-Security-Auditing 
31 
Account Usage 
Password Policy Checking API called 
4793 
Information 
Security 
Microsoft-Windows-Security-Auditing 
32 
Account Usage 
Security-enabled Group Created 
4731 
Information 
Security 
Microsoft-Windows-Security-Auditing 
33 
Account Usage 
Security-Enabled group Modification 
4735 
Information 
Security 
Microsoft-Windows-Security-Auditing 
34 
Account Usage 
SID History add attempted on Account 
4766 
Information 
Security 
Microsoft-Windows-Security-Auditing 
35 
Account Usage 
SID History added to Account 
4765 
Information 
Security 
Microsoft-Windows-Security-Auditing 
36 
Account Usage 
Successful User Account Login 
4624 
Information 
Security 
Microsoft-Windows-Security-Auditing 
37 
Account Usage 
User Account Deleted 
4726 
Information 
Security 
Microsoft-Windows-Security-Auditing 
38 
Account Usage 
User Account Disabled 
4725 
Information 
Security 
Microsoft-Windows-Security-Auditing 
39 
Account Usage 
User Account Unlocked 
4767 
Information 
Security 
Microsoft-Windows-Security-Auditing 
40 
Account Usage 
User Added to Privileged Group 
4728, 4732, 4756 
Information 
Security 
Microsoft-Windows-Security-Auditing 
41 
Account Usage 
User Right Assigned 
4704 
Information 
Security 
Microsoft-Windows-Security-Auditing 
42 
Application Whitelisting 
Process Created 
4688 
Information 
Security 
Microsoft-Windows-Security-Auditing 
43 
Application Whitelisting 
Process Terminated 
4689 
Information 
Security 
Microsoft-Windows-Security-Auditing 
44 
Certificate Services 
CA Services Request 
4886 
Information 
Security 
Microsoft-Windows-Security-Auditing 
45 
Certificate Services 
Certificate Manager Settings Changed 
4890 
Information 
Security 
Microsoft-Windows-Security-Auditing 
46 
Certificate Services 
Certificate Request Attributes Changed 
4874 
Information 
Security 
Microsoft-Windows-Security-Auditing 
47 
Certificate Services 
Certificate Request Extension Changed 
4873 
Information 
Security 
Microsoft-Windows-Security-Auditing 
48 
Certificate Services 
Certificate Revoked 
4870 
Information 
Security 
Microsoft-Windows-Security-Auditing 
49 
Certificate Services 
Certificate Services approved request 
4887 
Information 
Security 
Microsoft-Windows-Security-Auditing 
50 
Certificate Services 
Certificate Services Audit Filter Changed 
4885 
Information 
Security 
Microsoft-Windows-Security-Auditing 
51 
Certificate Services 
Certificate Services Configuration Changed 
4891 
Information 
Security 
Microsoft-Windows-Security-Auditing 
52 
Certificate Services 
Certificate Services denied request 
4888 
Information 
Security 
Microsoft-Windows-Security-Auditing 
53 
Certificate Services 
Certificate Services Loaded Template 
4898 
Information 
Security 
Microsoft-Windows-Security-Auditing 
54 
Certificate Services 
Certificate Services Permissions Changed 
4882 
Information 
Security 
Microsoft-Windows-Security-Auditing 
55 
Certificate Services 
Certificate Services Property Changed 
4892 
Information 
Security 
Microsoft-Windows-Security-Auditing 
56 
Certificate Services 
Certificate Services Started 
4880 
Information 
Security 
Microsoft-Windows-Security-Auditing 
57 
Certificate Services 
Certificate Services Stopped 
4881 
Information 
Security 
Microsoft-Windows-Security-Auditing 
58 
Certificate Services 
Certificate Services Template Security Updated 
4900 
Information 
Security 
Microsoft-Windows-Security-Auditing 
59 
Certificate Services 
Certificate Services Template Updated 
4899 
Information 
Security 
Microsoft-Windows-Security-Auditing 
60 
Certificate Services 
Entries Removed from Certificate Database 
4896 
Information 
Security 
Microsoft-Windows-Security-Auditing 
61 
Clearing Event Logs 
Event Log Service Shutdown 
1100 
Information 
Security 
Microsoft-Windows-EventLog 
62 
Clearing Event Logs 
Event Log was Cleared 
1102 
Information 
Security 
Microsoft-Windows-Eventlog 
63 
DNS/Directory Services 
Directory service created 
5137 
Information 
Security 
Microsoft-Windows-Security-Auditing 
64 
DNS/Directory Services 
Directory service deleted 
5141 
Information 
Security 
Microsoft-Windows-Security-Auditing 
65 
DNS/Directory Services 
Directory service modified 
5136 
Information 
Security 
Microsoft-Windows-Security-Auditing 
66 
DNS/Directory Services 
Directory service moved 
5139 
Information 
Security 
Microsoft-Windows-Security-Auditing 
67 
DNS/Directory Services 
Directory service recovered 
5138 
Information 
Security 
Microsoft-Windows-Security-Auditing 
68 
Kernel Driver Signing 
Detected an invalid image hash of a file 
5038 
Information 
Security 
Microsoft-Windows-Security-Auditing 
69 
Kernel Driver Signing 
Detected an invalid page hash of an image file 
6281 
Information 
Security 
Microsoft-Windows-Security-Auditing 
70 
Network Policy 
Encrypted Data Recovery Policy Changed 
4714 
Information 
Security 
Microsoft-Windows-Security-Auditing 
71 
Network Policy 
Kerberos Policy Changed 
4713 
Information 
Security 
Microsoft-Windows-Security-Auditing 
72 
Network Policy 
Kerberos Service Ticket Req. Failed 
4769 
Information 
Security 
Microsoft-Windows-Security-Auditing 
73 
Network Policy 
Network Policy Server Denied Access 
6273 
Information 
Security 
Microsoft-Windows-Security-Auditing 
74 
Network Policy 
Network Policy Server Discarded Accounting Request 
6275 
Information 
Security 
Microsoft-Windows-Security-Auditing 
75 
Network Policy 
Network Policy Server Discarded Request 
6274 
Information 
Security 
Microsoft-Windows-Security-Auditing 
76 
Network Policy 
Network Policy Server Granted Access 
6272 
Information 
Security 
Microsoft-Windows-Security-Auditing 
77 
Network Policy 
Network Policy Server Granted Full Access 
6278 
Information 
Security 
Microsoft-Windows-Security-Auditing 
78 
Network Policy 
Network Policy Server Granted Probationary Access 
6277 
Information 
Security 
Microsoft-Windows-Security-Auditing 
79 
Network Policy 
Network Policy Server Locked Account 
6279 
Information 
Security 
Microsoft-Windows-Security-Auditing 
80 
Network Policy 
Network Policy Server Quarantined User 
6276 
Information 
Security 
Microsoft-Windows-Security-Auditing 
81 
Network Policy 
Network Policy Server Unlocked Account 
6280 
Information 
Security 
Microsoft-Windows-Security-Auditing 
82 
Network Policy 
Network share accessed 
5140 
Information 
Security 
Microsoft-Windows-Security-Auditing 
83 
Network Policy 
Network Share Checked 
5145 
Information 
Security 
Microsoft-Windows-Security-Auditing 
84 
Network Policy 
Network Share Created 
5142 
Information 
Security 
Microsoft-Windows-Security-Auditing 
85 
Network Policy 
Network Share Deleted 
5144 
Information 
Security 
Microsoft-Windows-Security-Auditing 
86 
Network Policy 
New Trust for Domain 
4706 
Information 
Security 
Microsoft-Windows-Security-Auditing 
87 
Network Policy 
Role Separation Enabled 
4897 
Information 
Security 
Microsoft-Windows-Security-Auditing 
88 
Network Policy 
System Audit Policy Changed 
4719 
Information 
Security 
Microsoft-Windows-Security-Auditing 
89 
Network Policy 
Trusted Domain Information Modified 
4716 
Information 
Security 
Microsoft-Windows-Security-Auditing 
90 
Network Policy 
TS Session Disconnect 
4779 
Information 
Security 
Microsoft-Windows-Security-Auditing 
91 
Network Policy 
TS Session Reconnect 
4778 
Information 
Security 
Microsoft-Windows-Security-Auditing 
92 
Network Policy 
Wireless 802.1X Auth 
5632 
Information 
Security 
Microsoft-Windows-Security-Auditing 
93 
System Integrity 
Registry Modification 
4657 
Information 
Security 
Microsoft-Windows-Security-Auditing 
94 
Network Policy 
RADIUS User assigned IP 
20250 
Success 
RemoteAccess 
Microsoft-Windows-MPRMSG 
95 
Network Policy 
RADIUS User Authenticated 
20274 
Success 
RemoteAccess 
Microsoft-Windows-MPRMSG 
96 
Network Policy 
RADIUS User Disconnected 
20275 
Success 
RemoteAccess 
Microsoft-Windows-MPRMSG 
97 
PowerShell Activities 
Get-MessageTrackingLog cmdlet 
800 
Information 
Powershell 
Microsoft-Windows-Powershell 
98 
PowerShell Activities 
Remote Connection 
169 
Information 
Powershell 
Microsoft-Windows-Powershell 
99 
Mobile Device Activities 
Disconnect from Wireless connection 
8003 
Information 
Microsoft-Windows-WLAN-AutoConfig/Operational 
Microsoft-Windows-WLAN-AutoConfig 
100 
Mobile Device Activities 
Starting a Wireless connection 
8000, 8011 
Information 
Microsoft-Windows-WLAN-AutoConfig/Operational 
Microsoft-Windows-WLAN-AutoConfig 
101 
Mobile Device Activities 
Successfully connected to a Wireless connection 
8001 
Information 
Microsoft-Windows-WLAN-AutoConfig/Operational 
Microsoft-Windows-WLAN-AutoConfig 
102 
Mobile Device Activities 
Wireless Association Status 
11000, 11001 
Information 
Microsoft-Windows-WLAN-AutoConfig/Operational 
Microsoft-Windows-WLAN-AutoConfig 
103 
Mobile Device Activities 
Wireless Association Status 
11002 
Error 
Microsoft-Windows-WLAN-AutoConfig/Operational 
Microsoft-Windows-WLAN-AutoConfig 
104 
Mobile Device Activities 
Wireless Authentication Started and Failed 
12011, 12012 
Information 
Microsoft-Windows-WLAN-AutoConfig/Operational 
Microsoft-Windows-WLAN-AutoConfig 
105 
Mobile Device Activities 
Wireless Authentication Started and Failed 
12013 
Error 
Microsoft-Windows-WLAN-AutoConfig/Operational 
Microsoft-Windows-WLAN-AutoConfig 
106 
Mobile Device Activities 
Wireless Connection Failed 
8002 
Error 
Microsoft-Windows-WLAN-AutoConfig/Operational 
Microsoft-Windows-WLAN-AutoConfig 
107 
Mobile Device Activities 
Wireless Security Started, Stopped, Successful, or Failed 
11004, 11005 
Information 
Microsoft-Windows-WLAN-AutoConfig/Operational 
Microsoft-Windows-WLAN-AutoConfig 
108 
Mobile Device Activities 
Wireless Security Started, Stopped, Successful, or Failed 
11010, 11006 
Error 
Microsoft-Windows-WLAN-AutoConfig/Operational 
Microsoft-Windows-WLAN-AutoConfig 
109 
Windows Update Errors 
Windows Update Failed 
20, 24, 25, 31, 34, 35 
Error 
Microsoft-Windows-WindowsUpdateClient/Operational 
Microsoft-Windows-WindowsUpdateClient 
110 
Windows Firewall 
Firewall Failed to load Group Policy 
2009 
Error 
Microsoft-Windows-Windows Firewall With Advanced Security/Firewall 
Microsoft-Windows-Windows Firewall With Advanced Security 
111 
Windows Firewall 
Firewall Rule Add 
2004 
Information 
Microsoft-Windows-Windows Firewall With Advanced Security/Firewall 
Microsoft-Windows-Windows Firewall With Advanced Security 
112 
Windows Firewall 
Firewall Rule Change 
2005 
Information 
Microsoft-Windows-Windows Firewall With Advanced Security/Firewall 
Microsoft-Windows-Windows Firewall With Advanced Security 
113 
Windows Firewall 
Firewall Rules Deleted 
2006, 2033 
Information 
Microsoft-Windows-Windows Firewall With Advanced Security/Firewall 
Microsoft-Windows-Windows Firewall With Advanced Security 
114 
Windows Defender Activities 
Action on Malware Failed 
1008 
Error 
Microsoft-Windows-Windows Defender/Operational 
Microsoft-Windows-Windows Defender 
115 
Windows Defender Activities 
Detected Malware 
1006, 1116 
Warning 
Microsoft-Windows-Windows Defender/Operational 
Microsoft-Windows-Windows Defender 
116 
Windows Defender Activities 
Failed to remove item from quarantine 
1010 
Error 
Microsoft-Windows-Windows Defender/Operational 
Microsoft-Windows-Windows Defender 
117 
Windows Defender Activities 
Failed to update engine 
2003 
Error 
Microsoft-Windows-Windows Defender/Operational 
Microsoft-Windows-Windows Defender 

	Category	Name	ID	Level	Event Log	Event Source
1	Boot Events	Shutdown Initiate Failed	1074	Warning	User32	User32
2	Application Crashes	BSOD	1001	Error	System	Microsoft-Windows-WER-SystemErrorReporting
3	Boot Events	Windows Shutdown	13	Information	System	Microsoft-Windows-Kernel-General
4	Boot Events	Windows Startup	12	Information	System	Microsoft-Windows-Kernel-General
5	Clearing Event Logs	Event Log was Cleared	104	Information	System	Microsoft-Windows-Eventlog
6	Group Policy Errors	Generic Internal Error	1126	Error	System	Microsoft-Windows-GroupPolicy
7	Group Policy Errors	Group Policy Application Failed due to Connectivity	1129	Error	System	Microsoft-Windows-GroupPolicy
8	Group Policy Errors	Internal Error	1125	Error	System	Microsoft-Windows-GroupPolicy
9	Kernel Driver Signing	Failed Kernel Driver Loading	219	Warning	System	Microsoft-Windows-Kernel-PnP
10	Software and Service Installation	New Kernel Filter Driver	6	Information	System	Microsoft-Windows-FilterManager
11	Software and Service Installation	New Windows Service	7045	Information	System	Microsoft-Windows-FilterManager
12	Software and Service Installation	Service Start Failure	7000	Error	System	Service Control Manager
13	Software and Service Installation	Windows Update Installed	19	Information	System	Microsoft-Windows-WindowsUpdateClient
14	System Integrity	System Time Changed	1	Information	System	Microsoft-Windows-Kernel-General
15	System or Service Failures	Windows Service Fails or Crashes	7022, 7023, 7024, 7026, 7031, 7032, 7034	Error	System	Service Control Manager
16	Software and Service Installation	Update Packages Installed	2	Information	Setup	Microsoft-Windows-Servicing
17	Windows Update Errors	Hotpatching Failed	1009	Information	Setup	Microsoft-Windows-Servicing
18	Account Usage	Account Lockouts	4740	Information	Security	Microsoft-Windows-Security-Auditing
19	Account Usage	Account Login with Explicit Credentials	4648	Information	Security	Microsoft-Windows-Security-Auditing
20	Account Usage	Account Name Changed	4781	Information	Security	Microsoft-Windows-Security-Auditing
21	Account Usage	Account removed from Local Sec. Grp.	4733	Information	Security	Microsoft-Windows-Security-Auditing
22	Account Usage	Credential Authentication	4776	Information	Security	Microsoft-Windows-Security-Auditing
23	Account Usage	Credentials backed up	5376	Information	Security	Microsoft-Windows-Security-Auditing
24	Account Usage	Credentials restored	5377	Information	Security	Microsoft-Windows-Security-Auditing
25	Account Usage	Failed User Account Login	4625	Information	Security	Microsoft-Windows-Security-Auditing
26	Account Usage	Logoff Event	4634	Information	Security	Microsoft-Windows-Security-Auditing
27	Account Usage	Logon with Special Privs	4672	Information	Security	Microsoft-Windows-Security-Auditing
28	Account Usage	New User Account Created	4720	Information	Security	Microsoft-Windows-Security-Auditing
29	Account Usage	New User Account Enabled	4722	Information	Security	Microsoft-Windows-Security-Auditing
30	Account Usage	Password Hash Accessed	4782	Information	Security	Microsoft-Windows-Security-Auditing
31	Account Usage	Password Policy Checking API called	4793	Information	Security	Microsoft-Windows-Security-Auditing
32	Account Usage	Security-enabled Group Created	4731	Information	Security	Microsoft-Windows-Security-Auditing
33	Account Usage	Security-Enabled group Modification	4735	Information	Security	Microsoft-Windows-Security-Auditing
34	Account Usage	SID History add attempted on Account	4766	Information	Security	Microsoft-Windows-Security-Auditing
35	Account Usage	SID History added to Account	4765	Information	Security	Microsoft-Windows-Security-Auditing
36	Account Usage	Successful User Account Login	4624	Information	Security	Microsoft-Windows-Security-Auditing
37	Account Usage	User Account Deleted	4726	Information	Security	Microsoft-Windows-Security-Auditing
38	Account Usage	User Account Disabled	4725	Information	Security	Microsoft-Windows-Security-Auditing
39	Account Usage	User Account Unlocked	4767	Information	Security	Microsoft-Windows-Security-Auditing
40	Account Usage	User Added to Privileged Group	4728, 4732, 4756	Information	Security	Microsoft-Windows-Security-Auditing
41	Account Usage	User Right Assigned	4704	Information	Security	Microsoft-Windows-Security-Auditing
42	Application Whitelisting	Process Created	4688	Information	Security	Microsoft-Windows-Security-Auditing
43	Application Whitelisting	Process Terminated	4689	Information	Security	Microsoft-Windows-Security-Auditing
44	Certificate Services	CA Services Request	4886	Information	Security	Microsoft-Windows-Security-Auditing
45	Certificate Services	Certificate Manager Settings Changed	4890	Information	Security	Microsoft-Windows-Security-Auditing
46	Certificate Services	Certificate Request Attributes Changed	4874	Information	Security	Microsoft-Windows-Security-Auditing
47	Certificate Services	Certificate Request Extension Changed	4873	Information	Security	Microsoft-Windows-Security-Auditing
48	Certificate Services	Certificate Revoked	4870	Information	Security	Microsoft-Windows-Security-Auditing
49	Certificate Services	Certificate Services approved request	4887	Information	Security	Microsoft-Windows-Security-Auditing
50	Certificate Services	Certificate Services Audit Filter Changed	4885	Information	Security	Microsoft-Windows-Security-Auditing
51	Certificate Services	Certificate Services Configuration Changed	4891	Information	Security	Microsoft-Windows-Security-Auditing
52	Certificate Services	Certificate Services denied request	4888	Information	Security	Microsoft-Windows-Security-Auditing
53	Certificate Services	Certificate Services Loaded Template	4898	Information	Security	Microsoft-Windows-Security-Auditing
54	Certificate Services	Certificate Services Permissions Changed	4882	Information	Security	Microsoft-Windows-Security-Auditing
55	Certificate Services	Certificate Services Property Changed	4892	Information	Security	Microsoft-Windows-Security-Auditing
56	Certificate Services	Certificate Services Started	4880	Information	Security	Microsoft-Windows-Security-Auditing
57	Certificate Services	Certificate Services Stopped	4881	Information	Security	Microsoft-Windows-Security-Auditing
58	Certificate Services	Certificate Services Template Security Updated	4900	Information	Security	Microsoft-Windows-Security-Auditing
59	Certificate Services	Certificate Services Template Updated	4899	Information	Security	Microsoft-Windows-Security-Auditing
60	Certificate Services	Entries Removed from Certificate Database	4896	Information	Security	Microsoft-Windows-Security-Auditing
61	Clearing Event Logs	Event Log Service Shutdown	1100	Information	Security	Microsoft-Windows-EventLog
62	Clearing Event Logs	Event Log was Cleared	1102	Information	Security	Microsoft-Windows-Eventlog
63	DNS/Directory Services	Directory service created	5137	Information	Security	Microsoft-Windows-Security-Auditing
64	DNS/Directory Services	Directory service deleted	5141	Information	Security	Microsoft-Windows-Security-Auditing
65	DNS/Directory Services	Directory service modified	5136	Information	Security	Microsoft-Windows-Security-Auditing
66	DNS/Directory Services	Directory service moved	5139	Information	Security	Microsoft-Windows-Security-Auditing
67	DNS/Directory Services	Directory service recovered	5138	Information	Security	Microsoft-Windows-Security-Auditing
68	Kernel Driver Signing	Detected an invalid image hash of a file	5038	Information	Security	Microsoft-Windows-Security-Auditing
69	Kernel Driver Signing	Detected an invalid page hash of an image file	6281	Information	Security	Microsoft-Windows-Security-Auditing
70	Network Policy	Encrypted Data Recovery Policy Changed	4714	Information	Security	Microsoft-Windows-Security-Auditing
71	Network Policy	Kerberos Policy Changed	4713	Information	Security	Microsoft-Windows-Security-Auditing
72	Network Policy	Kerberos Service Ticket Req. Failed	4769	Information	Security	Microsoft-Windows-Security-Auditing
73	Network Policy	Network Policy Server Denied Access	6273	Information	Security	Microsoft-Windows-Security-Auditing
74	Network Policy	Network Policy Server Discarded Accounting Request	6275	Information	Security	Microsoft-Windows-Security-Auditing
75	Network Policy	Network Policy Server Discarded Request	6274	Information	Security	Microsoft-Windows-Security-Auditing
76	Network Policy	Network Policy Server Granted Access	6272	Information	Security	Microsoft-Windows-Security-Auditing
77	Network Policy	Network Policy Server Granted Full Access	6278	Information	Security	Microsoft-Windows-Security-Auditing
78	Network Policy	Network Policy Server Granted Probationary Access	6277	Information	Security	Microsoft-Windows-Security-Auditing
79	Network Policy	Network Policy Server Locked Account	6279	Information	Security	Microsoft-Windows-Security-Auditing
80	Network Policy	Network Policy Server Quarantined User	6276	Information	Security	Microsoft-Windows-Security-Auditing
81	Network Policy	Network Policy Server Unlocked Account	6280	Information	Security	Microsoft-Windows-Security-Auditing
82	Network Policy	Network share accessed	5140	Information	Security	Microsoft-Windows-Security-Auditing
83	Network Policy	Network Share Checked	5145	Information	Security	Microsoft-Windows-Security-Auditing
84	Network Policy	Network Share Created	5142	Information	Security	Microsoft-Windows-Security-Auditing
85	Network Policy	Network Share Deleted	5144	Information	Security	Microsoft-Windows-Security-Auditing
86	Network Policy	New Trust for Domain	4706	Information	Security	Microsoft-Windows-Security-Auditing
87	Network Policy	Role Separation Enabled	4897	Information	Security	Microsoft-Windows-Security-Auditing
88	Network Policy	System Audit Policy Changed	4719	Information	Security	Microsoft-Windows-Security-Auditing
89	Network Policy	Trusted Domain Information Modified	4716	Information	Security	Microsoft-Windows-Security-Auditing
90	Network Policy	TS Session Disconnect	4779	Information	Security	Microsoft-Windows-Security-Auditing
91	Network Policy	TS Session Reconnect	4778	Information	Security	Microsoft-Windows-Security-Auditing
92	Network Policy	Wireless 802.1X Auth	5632	Information	Security	Microsoft-Windows-Security-Auditing
93	System Integrity	Registry Modification	4657	Information	Security	Microsoft-Windows-Security-Auditing
94	Network Policy	RADIUS User assigned IP	20250	Success	RemoteAccess	Microsoft-Windows-MPRMSG
95	Network Policy	RADIUS User Authenticated	20274	Success	RemoteAccess	Microsoft-Windows-MPRMSG
96	Network Policy	RADIUS User Disconnected	20275	Success	RemoteAccess	Microsoft-Windows-MPRMSG
97	PowerShell Activities	Get-MessageTrackingLog cmdlet	800	Information	Powershell	Microsoft-Windows-Powershell
98	PowerShell Activities	Remote Connection	169	Information	Powershell	Microsoft-Windows-Powershell
99	Mobile Device Activities	Disconnect from Wireless connection	8003	Information	Microsoft-Windows-WLAN-AutoConfig/Operational	Microsoft-Windows-WLAN-AutoConfig
100	Mobile Device Activities	Starting a Wireless connection	8000, 8011	Information	Microsoft-Windows-WLAN-AutoConfig/Operational	Microsoft-Windows-WLAN-AutoConfig
101	Mobile Device Activities	Successfully connected to a Wireless connection	8001	Information	Microsoft-Windows-WLAN-AutoConfig/Operational	Microsoft-Windows-WLAN-AutoConfig
102	Mobile Device Activities	Wireless Association Status	11000, 11001	Information	Microsoft-Windows-WLAN-AutoConfig/Operational	Microsoft-Windows-WLAN-AutoConfig
103	Mobile Device Activities	Wireless Association Status	11002	Error	Microsoft-Windows-WLAN-AutoConfig/Operational	Microsoft-Windows-WLAN-AutoConfig
104	Mobile Device Activities	Wireless Authentication Started and Failed	12011, 12012	Information	Microsoft-Windows-WLAN-AutoConfig/Operational	Microsoft-Windows-WLAN-AutoConfig
105	Mobile Device Activities	Wireless Authentication Started and Failed	12013	Error	Microsoft-Windows-WLAN-AutoConfig/Operational	Microsoft-Windows-WLAN-AutoConfig
106	Mobile Device Activities	Wireless Connection Failed	8002	Error	Microsoft-Windows-WLAN-AutoConfig/Operational	Microsoft-Windows-WLAN-AutoConfig
107	Mobile Device Activities	Wireless Security Started, Stopped, Successful, or Failed	11004, 11005	Information	Microsoft-Windows-WLAN-AutoConfig/Operational	Microsoft-Windows-WLAN-AutoConfig
108	Mobile Device Activities	Wireless Security Started, Stopped, Successful, or Failed	11010, 11006	Error	Microsoft-Windows-WLAN-AutoConfig/Operational	Microsoft-Windows-WLAN-AutoConfig
109	Windows Update Errors	Windows Update Failed	20, 24, 25, 31, 34, 35	Error	Microsoft-Windows-WindowsUpdateClient/Operational	Microsoft-Windows-WindowsUpdateClient
110	Windows Firewall	Firewall Failed to load Group Policy	2009	Error	Microsoft-Windows-Windows Firewall With Advanced Security/Firewall	Microsoft-Windows-Windows Firewall With Advanced Security
111	Windows Firewall	Firewall Rule Add	2004	Information	Microsoft-Windows-Windows Firewall With Advanced Security/Firewall	Microsoft-Windows-Windows Firewall With Advanced Security
112	Windows Firewall	Firewall Rule Change	2005	Information	Microsoft-Windows-Windows Firewall With Advanced Security/Firewall	Microsoft-Windows-Windows Firewall With Advanced Security
113	Windows Firewall	Firewall Rules Deleted	2006, 2033	Information	Microsoft-Windows-Windows Firewall With Advanced Security/Firewall	Microsoft-Windows-Windows Firewall With Advanced Security
114	Windows Defender Activities	Action on Malware Failed	1008	Error	Microsoft-Windows-Windows Defender/Operational	Microsoft-Windows-Windows Defender
115	Windows Defender Activities	Detected Malware	1006, 1116	Warning	Microsoft-Windows-Windows Defender/Operational	Microsoft-Windows-Windows Defender
116	Windows Defender Activities	Failed to remove item from quarantine	1010	Error	Microsoft-Windows-Windows Defender/Operational	Microsoft-Windows-Windows Defender
117	Windows Defender Activities	Failed to update engine	2003	Error	Microsoft-Windows-Windows Defender/Operational	Microsoft-Windows-Windows Defender