Windows Security Log Events by Category

Category: System Events
Policy: Audit system events

look up events by Event ID or Category

Overview:

System Events are an eclectic mix of system events relevant to security. Windows logs event ID 612 and event ID 613 when the system starts up and shuts down, respectively. These events are important because a Windows system is completely vulnerable while shutdown and at the mercy of anyone who has physical access and the proper skill....read more

Save $100 on Security Log Secrets Interactive Edition xzfg

Become a Security Log Expert

with Randy Smith's Security Log Secrets Seminar...

Event ID	OS:	Title:
512	All Versions	Windows NT is starting up
513	XP, Win2003	Windows NT is shutting down
514	All Versions	An authentication package has been loaded by the Local Security Authority
515	All Versions	A trusted logon process has registered with the Local Security Authority
516	All Versions	Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits
517	All Versions	The audit log was cleared
518	All Versions	An notification package has been loaded by the Security Account Manager
519	Win2003	A process is using an invalid local procedure call (LPC) port
520	Win2003	The system time was changed

Additional Links

A
D
V

Sick of LimitLogin? Get UserLock for real logon control

NEW! GFI EventsManager 8 Extends Event Management Capabilities. Find Out More.

Get Randy's Security Log Resource Kit

Windows Security Log Events by Category

Category: System Events Policy: Audit system events

Overview:

Become a Security Log Expert

Additional Links

Category: System Events
Policy: Audit system events