Windows Security Log Events

All Sources
Windows Audit
SharePoint Audit (LOGbinder for SharePoint)
SQL Server Audit (LOGbinder for SQL Server)
Exchange Audit (LOGbinder for Exchange)
Sysmon (MS Sysinternals Sysmon)

Windows Audit Categories:

Subcategories:

Windows Versions: All events
Win2000, XP and Win2003 only
Win2008, Win2012R2, Win2016 and Win10+, Win2019 Required when sub-category selected.

Category: Policy Change
Subcategory: Authorization Policy Change

Windows	4670	Permissions on an object were changed
Windows	4703	A token right was adjusted
Windows	4704	A user right was assigned
Windows	4705	A user right was removed
Windows	4714	Encrypted data recovery policy was changed
Windows	4911	Resource attributes of the object were changed
Windows	4913	Central Access Policy on the object was changed

Upcoming Webinars

Live, Hands-on Deep-Dive into LLM Hacking: Prompt Injection, Model Context Protocol and Skills
AD Certificate Services: A Massive Chunk of Windows Security Functionality Finally Gets the Security Research It Deserves
Linux Security: Locking Down Admin Access with SSH and Sudo
Understanding Broken Object Level Authorization: The Quiet Access Control Failure Undermining Today’s Apps

Additional Resources

Encyclopedia

•	Event IDs
•	All Event IDs
•	Audit Policy

Go To Event ID:

Security Log
Quick Reference
Chart
Download now!

User name:
Password:
	/ Forgot?
	Register

January 2026 Patch Tuesday	"Patch Tuesday - Starting 2026 with a Bang; 3 Zero Days " - sponsored by LOGbinder and Supercharger

Home

Follow @randyfsmith

About | Newsletter | Contact

Ultimate IT Security is a division of Monterey Technology Group, Inc. ©2006-2026 Monterey Technology Group, Inc. All rights reserved.
Disclaimer: We do our best to provide quality information and expert commentary but use all information at your own risk. For complaints, please contact abuse@ultimatewindowssecurity.com.