Windows Security Log Events



(LOGbinder for SharePoint)
(LOGbinder for SQL Server)
(LOGbinder for Exchange)
(MS Sysinternals Sysmon)
Windows Audit Categories:

Subcategories:

Windows Versions:

Category: Account Management
Windows 4720 A user account was created
Windows 4722 A user account was enabled
Windows 4723 An attempt was made to change an account's password
Windows 4724 An attempt was made to reset an accounts password
Windows 4725 A user account was disabled
Windows 4726 A user account was deleted
Windows 4727 A security-enabled global group was created
Windows 4728 A member was added to a security-enabled global group
Windows 4729 A member was removed from a security-enabled global group
Windows 4730 A security-enabled global group was deleted
Windows 4731 A security-enabled local group was created
Windows 4732 A member was added to a security-enabled local group
Windows 4733 A member was removed from a security-enabled local group
Windows 4734 A security-enabled local group was deleted
Windows 4735 A security-enabled local group was changed
Windows 4737 A security-enabled global group was changed
Windows 4738 A user account was changed
Windows 4739 Domain Policy was changed
Windows 4740 A user account was locked out
Windows 4741 A computer account was created
Windows 4742 A computer account was changed
Windows 4743 A computer account was deleted
Windows 4744 A security-disabled local group was created
Windows 4745 A security-disabled local group was changed
Windows 4746 A member was added to a security-disabled local group
Windows 4747 A member was removed from a security-disabled local group
Windows 4748 A security-disabled local group was deleted
Windows 4749 A security-disabled global group was created
Windows 4750 A security-disabled global group was changed
Windows 4751 A member was added to a security-disabled global group
Windows 4752 A member was removed from a security-disabled global group
Windows 4753 A security-disabled global group was deleted
Windows 4754 A security-enabled universal group was created
Windows 4755 A security-enabled universal group was changed
Windows 4756 A member was added to a security-enabled universal group
Windows 4757 A member was removed from a security-enabled universal group
Windows 4758 A security-enabled universal group was deleted
Windows 4759 A security-disabled universal group was created
Windows 4760 A security-disabled universal group was changed
Windows 4761 A member was added to a security-disabled universal group
Windows 4762 A member was removed from a security-disabled universal group
Windows 4763 A security-disabled universal group was deleted
Windows 4764 A groups type was changed
Windows 4765 SID History was added to an account
Windows 4766 An attempt to add SID History to an account failed
Windows 4767 A user account was unlocked
Windows 4780 The ACL was set on accounts which are members of administrators groups
Windows 4781 The name of an account was changed
Windows 4782 The password hash an account was accessed
Windows 4783 A basic application group was created
Windows 4784 A basic application group was changed
Windows 4785 A member was added to a basic application group
Windows 4786 A member was removed from a basic application group
Windows 4787 A non-member was added to a basic application group
Windows 4788 A non-member was removed from a basic application group..
Windows 4789 A basic application group was deleted
Windows 4790 An LDAP query group was created
Windows 4791 A basic application group was changed
Windows 4792 An LDAP query group was deleted
Windows 4793 The Password Policy Checking API was called
Windows 4794 An attempt was made to set the Directory Services Restore Mode administrator password
Windows 4797 An attempt was made to query the existence of a blank password for an account
Windows 4798 A user's local group membership was enumerated.
Windows 4799 A security-enabled local group membership was enumerated
Windows 5376 Credential Manager credentials were backed up
Windows 5377 Credential Manager credentials were restored from a backup

Stay up-to-date on the Latest in Cybersecurity
Sign up for the Ultimate IT Security newsletter to hear about the latest webinars, patches, CVEs, attacks, and more.
Work Email:

 

Upcoming Webinars
Additional Resources