Windows Security Log Events
All Sources
Windows Audit
SharePoint Audit
(
LOGbinder for SharePoint
)
SQL Server Audit
(
LOGbinder for SQL Server
)
Exchange Audit
(
LOGbinder for Exchange
)
Sysmon
(
MS Sysinternals Sysmon
)
Windows Audit Categories:
All categories
Account Logon
Account Management
Directory Service
Logon/Logoff
Non Audit (Event Log)
Object Access
Policy Change
Privilege Use
Process Tracking
System
Uncategorized
Subcategories:
All subcategories
Account Lockout
Group Membership
IPsec Extended Mode
IPsec Main Mode
IPsec Quick Mode
Logoff
Logon
Network Policy Server
Other Logon/Logoff Events
Special Logon
Windows Versions:
All events
Win2000, XP and Win2003 only
Win2008, Win2012R2, Win2016 and Win10+, Win2019
Required when sub-category selected.
Category:
Logon/Logoff
Subcategory:
Network Policy Server
Windows
6272
Network Policy Server granted access to a user
Windows
6273
Network Policy Server denied access to a user
Windows
6274
Network Policy Server discarded the request for a user
Windows
6275
Network Policy Server discarded the accounting request for a user
Windows
6276
Network Policy Server quarantined a user
Windows
6277
Network Policy Server granted access to a user but put it on probation because the host did not meet the defined health policy
Windows
6278
Network Policy Server granted full access to a user because the host met the defined health policy
Windows
6279
Network Policy Server locked the user account due to repeated failed authentication attempts
Windows
6280
Network Policy Server unlocked the user account
Stay up-to-date on the Latest in Cybersecurity
Sign up for the Ultimate IT Security newsletter to hear about the latest webinars, patches, CVEs, attacks, and more.
Work Email:
Upcoming Webinars
File Security in Microsoft 365: Under Teams, OneDrive for Business, Microsoft 365 Groups it’s SharePoint
Understanding Broken Object Level Authorization: The Quiet Access Control Failure Undermining Today’s Apps
Additional Resources
Encyclopedia
•
Event IDs
•
All Event IDs
•
Audit Policy
Go To Event ID:
Security Log
Quick Reference
Chart
Download now!
Tweet
User name:
Password:
/
Forgot?
Register
January 2026
Patch Tuesday
"Patch Tuesday - Starting 2026 with a Bang; 3 Zero Days " - sponsored by LOGbinder and Supercharger
Home
Cookies help us deliver the best experience on our website. By using our website, you agree to the use of cookies.