| 1 | | 1 | none | |
| 1074 | | 1 | none | |
| 1100Event Log Service Shutdown | | 0 | Splunk 1 | NSA |
| 1166 | | 1 | none | |
| 1200 | | 1 | none | |
| 1202 | | 1 | none | |
| 3033 | | 1 | none | |
| 4608Windows is starting up. | Advanced Audit Policy: System > Audit Security State Change | 0 | none | STIG, Microsoft |
| 4610An authentication package has been loaded by the Local Security Authority. | Advanced Audit Policy: System > Audit Security System Extension | 0 | none | STIG, Microsoft |
| 4611A trusted logon process has been registered with the Local Security Authority. | Advanced Audit Policy: System > Audit Security System Extension | 0 | Sigma 1 | STIG, Microsoft |
| 4612Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits. | Advanced Audit Policy: System > Audit System Integrity | 0 | none | STIG, Microsoft |
| 4614A notification package has been loaded by the Security Account Manager. | Advanced Audit Policy: System > Audit Security System Extension | 0 | none | STIG, Microsoft |
| 4615Invalid use of LPC port. | Advanced Audit Policy: System > Audit System Integrity | 0 | none | STIG, Microsoft |
| 4616The system time was changed. | Advanced Audit Policy: System > Audit Security State Change | 0 | Sigma 1 | STIG, Microsoft |
| 4618A monitored security event pattern has occurred. | Advanced Audit Policy: System > Audit System Integrity | 0 | none | STIG, Microsoft |
| 4621Administrator recovered system from CrashOnAuditFail. Users who are not administrators will now be allowed to log on. Some auditable activity might not have been recorded. | Advanced Audit Policy: System > Audit Security State Change | 0 | none | STIG, Microsoft |
| 4622A security package has been loaded by the Local Security Authority. | Advanced Audit Policy: System > Audit Security System Extension | 0 | none | STIG, Microsoft |
| 4627 | Advanced Audit Policy: Logon/Logoff > Audit Group Membership | 0 | Splunk 1 | STIG |
| 4647User initiated logoff. | Advanced Audit Policy: Logon/Logoff > Audit Logoff | 0 | Sigma 1, Microsoft Sentinel 1 | STIG, Microsoft |
| 4649A replay attack was detected. May be a harmless false positive due to misconfiguration error. | Advanced Audit Policy: Logon/Logoff > Audit Other Logon/Logoff Events | 0 | Sigma 1 | STIG, Microsoft |
| 4660An object was deleted. | Advanced Audit Policy: Object Access > Audit File System | 0 | none | M-26-14, STIG, Microsoft |
| 4664An attempt was made to create a hard link. | Advanced Audit Policy: Object Access > Audit File System | 0 | none | STIG, Microsoft |
| 4671An application attempted to access a blocked ordinal through the TBS. | Advanced Audit Policy: Object Access > Audit Other Object Access Events | 0 | none | STIG, Microsoft |
| 4674An operation was attempted on a privileged object. | Advanced Audit Policy: Privilege Use > Audit Non-Sensitive Privilege Use | 0 | Sigma 1, Elastic 1 | M-26-14, STIG, Microsoft |
| 4675SIDs were filtered. | Advanced Audit Policy: Logon/Logoff > Audit Logon | 0 | Microsoft Sentinel 1 | STIG, Microsoft |
| 4689A process has exited. | Advanced Audit Policy: Detailed Tracking > Audit Process Termination | 0 | none | NSA, Microsoft |
| 4690An attempt was made to duplicate a handle to an object. | Advanced Audit Policy: Object Access > Audit Handle Manipulation | 0 | none | STIG, Microsoft |
| 4691Indirect access to an object was requested. | Advanced Audit Policy: Object Access > Audit Other Object Access Events | 0 | none | STIG, Microsoft |
| 4692Backup of data protection master key was attempted. | Advanced Audit Policy: Detailed Tracking > Audit DPAPI Activity | 0 | Sigma 1 | Microsoft |
| 4693Recovery of data protection master key was attempted. | Advanced Audit Policy: Detailed Tracking > Audit DPAPI Activity | 0 | none | Microsoft |
| 4696A primary token was assigned to process. | Advanced Audit Policy: Detailed Tracking > Audit Process Creation | 0 | none | STIG, Microsoft |
| 4699A scheduled task was deleted. | Advanced Audit Policy: Object Access > Audit Other Object Access Events | 0 | Splunk 1, Sigma 3, Microsoft Sentinel 1 | STIG, Microsoft |
| 4700A scheduled task was enabled. | Advanced Audit Policy: Object Access > Audit Other Object Access Events | 0 | Splunk 2, Microsoft Sentinel 1 | STIG, Microsoft |
| 4701A scheduled task was disabled. | Advanced Audit Policy: Object Access > Audit Other Object Access Events | 0 | Sigma 2, Microsoft Sentinel 1 | STIG, Microsoft |
| 4703 | Advanced Audit Policy: Detailed Tracking > Audit Token Right Adjusted | 0 | Splunk 1 | STIG |
| 4705A user right was removed. | Advanced Audit Policy: Policy Change > Audit Authorization Policy Change | 0 | none | STIG, Microsoft |
| 4706A new trust was created to a domain. | Advanced Audit Policy: Policy Change > Audit Authentication Policy Change | 0 | Sigma 1 | STIG, NSA, Microsoft |
| 4707A trust to a domain was removed. | Advanced Audit Policy: Policy Change > Audit Authentication Policy Change | 0 | none | STIG, Microsoft |
| 4713Kerberos policy was changed. | Advanced Audit Policy: Policy Change > Audit Authentication Policy Change | 0 | none | STIG, NSA, Microsoft |
| 4714Encrypted data recovery policy was changed. | Advanced Audit Policy: Policy Change > Audit Other Policy Change Events | 0 | none | STIG, NSA, Microsoft |
| 4715The audit policy (SACL) on an object was changed. | Advanced Audit Policy: Policy Change > Audit Audit Policy Change | 0 | none | STIG, Microsoft |
| 4716Trusted domain information was modified. | Advanced Audit Policy: Policy Change > Audit Authentication Policy Change | 0 | none | STIG, NSA, Microsoft |
| 4717System security access was granted to an account. | Advanced Audit Policy: Policy Change > Audit Authentication Policy Change | 0 | none | STIG, Microsoft |
| 4718System security access was removed from an account. | Advanced Audit Policy: Policy Change > Audit Authentication Policy Change | 0 | none | STIG, Microsoft |
| 4719System audit policy was changed. | Advanced Audit Policy: Policy Change > Audit Audit Policy Change | 0 | Splunk 2, Sigma 2, Elastic 1 | STIG, NSA, Microsoft |
| 4722A user account was enabled. | Advanced Audit Policy: Account Management > Audit User Account Management | 0 | Microsoft Sentinel 2 | STIG, NSA, Microsoft |
| 4725A user account was disabled. | Advanced Audit Policy: Account Management > Audit User Account Management | 0 | Splunk 1, Microsoft Sentinel 1 | STIG, NSA, Microsoft |
| 4727A security-enabled global group was created. | Advanced Audit Policy: Account Management > Audit Security Group Management | 0 | Splunk 2, Sigma 1, Microsoft Sentinel 1 | STIG, Microsoft |
| 4730A security-enabled global group was deleted. | Advanced Audit Policy: Account Management > Audit Security Group Management | 0 | Splunk 1, Sigma 1 | STIG, Microsoft |
| 4731A security-enabled local group was created. | Advanced Audit Policy: Account Management > Audit Security Group Management | 0 | Splunk 1, Sigma 1, Microsoft Sentinel 1 | STIG, NSA, Microsoft |
| 4734A security-enabled local group was deleted. | Advanced Audit Policy: Account Management > Audit Security Group Management | 0 | none | STIG, Microsoft |
| 4735A security-enabled local group was changed. | Advanced Audit Policy: Account Management > Audit Security Group Management | 0 | none | STIG, NSA, Microsoft |
| 4737A security-enabled global group was changed. | Advanced Audit Policy: Account Management > Audit Security Group Management | 0 | Splunk 1, Sigma 1 | STIG, Microsoft |
| 4741A computer account was changed. | Advanced Audit Policy: Account Management > Audit Computer Account Management | 0 | Splunk 2, Sigma 2 | M-26-14, STIG, Microsoft |
| 4742A computer account was changed. | Advanced Audit Policy: Account Management > Audit Computer Account Management | 0 | Splunk 6, Sigma 1 | M-26-14, STIG, Microsoft |
| 4743A computer account was deleted. | Advanced Audit Policy: Account Management > Audit Computer Account Management | 0 | Sigma 1 | M-26-14, STIG, Microsoft |
| 4754A security-enabled universal group was created. | Advanced Audit Policy: Account Management > Audit Security Group Management | 0 | Splunk 1, Sigma 1, Microsoft Sentinel 1 | STIG, Microsoft |
| 4755A security-enabled universal group was changed. | Advanced Audit Policy: Account Management > Audit Security Group Management | 0 | Sigma 1 | STIG, Microsoft |
| 4758A security-enabled universal group was deleted. | Advanced Audit Policy: Account Management > Audit Security Group Management | 0 | none | STIG, Microsoft |
| 4764A security-disabled group was deleted. | Advanced Audit Policy: Account Management > Audit Security Group Management | 0 | none | STIG, Microsoft |
| 4765SID History was added to an account. | Advanced Audit Policy: Account Management > Audit User Account Management | 0 | Sigma 1 | STIG, NSA, Microsoft |
| 4766An attempt to add SID History to an account failed. | Advanced Audit Policy: Account Management > Audit User Account Management | 0 | Sigma 1 | STIG, NSA, Microsoft |
| 4767A user account was unlocked. | Advanced Audit Policy: Account Management > Audit User Account Management | 0 | none | STIG, NSA, Microsoft |
| 4772A Kerberos authentication ticket request failed. | Advanced Audit Policy: Account Logon > Audit Kerberos Authentication Service | 0 | none | Microsoft |
| 4773 | Advanced Audit Policy: Account Logon > Audit Kerberos Service Ticket Operations | 0 | none | |
| 4774An account was mapped for logon. | Advanced Audit Policy: Account Logon > Audit Credential Validation | 0 | none | STIG, Microsoft |
| 4775An account could not be mapped for logon. | Advanced Audit Policy: Account Logon > Audit Credential Validation | 0 | none | STIG, Microsoft |
| 4777The domain controller failed to validate the credentials for an account. | Advanced Audit Policy: Account Logon > Audit Credential Validation | 0 | none | STIG, Microsoft |
| 4779A session was disconnected from a Window Station. | Advanced Audit Policy: Logon/Logoff > Audit Other Logon/Logoff Events | 0 | none | STIG, NSA, Microsoft |
| 4780The ACL was set on accounts which are members of administrators groups. | Advanced Audit Policy: Account Management > Audit User Account Management | 0 | none | STIG, Microsoft |
| 4781The name of an account was changed. | Advanced Audit Policy: Account Management > Audit User Account Management | 0 | Splunk 3, Sigma 2 | STIG, NSA, Microsoft |
| 4782The password hash an account was accessed. | Advanced Audit Policy: Account Management > Audit Other Account Management Events | 0 | none | STIG, NSA, Microsoft |
| 4793The Password Policy Checking API was called. | Advanced Audit Policy: Account Management > Audit Other Account Management Events | 0 | none | STIG, NSA, Microsoft |
| 4794An attempt was made to set the Directory Services Restore Mode. | Advanced Audit Policy: Account Management > Audit User Account Management | 0 | Splunk 1, Sigma 1 | STIG, Microsoft |
| 4802The screen saver was invoked. | Advanced Audit Policy: Logon/Logoff > Audit Other Logon/Logoff Events | 0 | none | STIG, Microsoft |
| 4803The screen saver was dismissed. | Advanced Audit Policy: Logon/Logoff > Audit Other Logon/Logoff Events | 0 | none | STIG, Microsoft |
| 4816RPC detected an integrity violation while decrypting an incoming message. | Advanced Audit Policy: System > Audit System Integrity | 0 | none | STIG, Microsoft |
| 4817 | Advanced Audit Policy: Policy Change > Audit Audit Policy Change | 0 | none | STIG |
| 4819 | Advanced Audit Policy: Policy Change > Audit Other Policy Change Events | 0 | none | STIG |
| 4826 | Advanced Audit Policy: Policy Change > Audit Other Policy Change Events | 0 | none | STIG |
| 4864A namespace collision was detected. | Advanced Audit Policy: Policy Change > Audit Authentication Policy Change | 0 | none | STIG, Microsoft |
| 4865A trusted forest information entry was added. | Advanced Audit Policy: Policy Change > Audit Authentication Policy Change | 0 | none | STIG, Microsoft |
| 4866A trusted forest information entry was removed. | Advanced Audit Policy: Policy Change > Audit Authentication Policy Change | 0 | none | STIG, Microsoft |
| 4867A trusted forest information entry was modified. | Advanced Audit Policy: Policy Change > Audit Authentication Policy Change | 0 | none | STIG, Microsoft |
| 4899Certificate Services Template Updated | | 0 | Sigma 2 | NSA |
| 4900Certificate Services Template Security Updated | | 0 | none | NSA |
| 4902The Per-user audit policy table was created. | Advanced Audit Policy: Policy Change > Audit Audit Policy Change | 0 | none | STIG, Microsoft |
| 4904An attempt was made to register a security event source. | Advanced Audit Policy: Policy Change > Audit Audit Policy Change | 0 | Sigma 1 | STIG, Microsoft |
| 4905An attempt was made to unregister a security event source. | Advanced Audit Policy: Policy Change > Audit Audit Policy Change | 0 | Sigma 1 | STIG, Microsoft |
| 4906The CrashOnAuditFail value has changed. | Advanced Audit Policy: Policy Change > Audit Audit Policy Change | 0 | none | STIG, Microsoft |
| 4907Auditing settings on object were changed. | Advanced Audit Policy: Policy Change > Audit Audit Policy Change | 0 | none | STIG, Microsoft |
| 4908Special Groups Logon table modified. | Advanced Audit Policy: Policy Change > Audit Audit Policy Change | 0 | none | STIG, Microsoft |
| 4909The local policy settings for the TBS were changed. | Advanced Audit Policy: Policy Change > Audit Other Policy Change Events | 0 | none | STIG, Microsoft |
| 4910The Group Policy settings for the TBS were changed. | Advanced Audit Policy: Policy Change > Audit Other Policy Change Events | 0 | none | STIG, Microsoft |
| 4911 | Advanced Audit Policy: Policy Change > Audit Authorization Policy Change | 0 | none | STIG |
| 4912Per User Audit Policy was changed. | Advanced Audit Policy: Policy Change > Audit Audit Policy Change | 0 | none | STIG, Microsoft |
| 4913 | Advanced Audit Policy: Policy Change > Audit Authorization Policy Change | 0 | none | STIG |
| 4928An Active Directory replica source naming context was established. | Advanced Audit Policy: DS Access > Audit Detailed Directory Service Replication | 1 | none | Microsoft |
| 4929An Active Directory replica source naming context was removed. | Advanced Audit Policy: DS Access > Audit Detailed Directory Service Replication | 2 | none | Microsoft |
| 4944The following policy was active when the Windows Firewall started. | Advanced Audit Policy: Policy Change > Audit MPSSVC Rule-Level Policy Change | 0 | none | STIG, Microsoft |
| 4945A rule was listed when the Windows Firewall started. | Advanced Audit Policy: Policy Change > Audit MPSSVC Rule-Level Policy Change | 0 | none | STIG, Microsoft |
| 4946A change has been made to Windows Firewall exception list. A rule was added. | Advanced Audit Policy: Policy Change > Audit MPSSVC Rule-Level Policy Change | 0 | Splunk 1 | STIG, Microsoft |
| 4947A change has been made to Windows Firewall exception list. A rule was modified. | Advanced Audit Policy: Policy Change > Audit MPSSVC Rule-Level Policy Change | 0 | Splunk 1 | STIG, Microsoft |
| 4948A change has been made to Windows Firewall exception list. A rule was deleted. | Advanced Audit Policy: Policy Change > Audit MPSSVC Rule-Level Policy Change | 0 | Splunk 1 | STIG, Microsoft |
| 4949Windows Firewall settings were restored to the default values. | Advanced Audit Policy: Policy Change > Audit MPSSVC Rule-Level Policy Change | 0 | none | STIG, Microsoft |
| 4950A Windows Firewall setting has changed. | Advanced Audit Policy: Policy Change > Audit MPSSVC Rule-Level Policy Change | 0 | none | STIG, Microsoft |
| 4951A rule has been ignored because its major version number was not recognized by Windows Firewall. | Advanced Audit Policy: Policy Change > Audit MPSSVC Rule-Level Policy Change | 0 | none | STIG, Microsoft |
| 4952Parts of a rule have been ignored because its minor version number was not recognized by Windows Firewall. The other parts of the rule will be enforced. | Advanced Audit Policy: Policy Change > Audit MPSSVC Rule-Level Policy Change | 0 | none | STIG, Microsoft |
| 4953A rule has been ignored by Windows Firewall because it could not parse the rule. | Advanced Audit Policy: Policy Change > Audit MPSSVC Rule-Level Policy Change | 0 | none | STIG, Microsoft |
| 4954Windows Firewall Group Policy settings have changed. The new settings have been applied. | Advanced Audit Policy: Policy Change > Audit MPSSVC Rule-Level Policy Change | 0 | none | STIG, Microsoft |
| 4956Windows Firewall has changed the active profile. | Advanced Audit Policy: Policy Change > Audit MPSSVC Rule-Level Policy Change | 0 | none | STIG, Microsoft |
| 4957Windows Firewall did not apply the following rule. | Advanced Audit Policy: Policy Change > Audit MPSSVC Rule-Level Policy Change | 0 | none | STIG, Microsoft |
| 4958Windows Firewall did not apply the following rule because the rule referred to items not configured on this computer. | Advanced Audit Policy: Policy Change > Audit MPSSVC Rule-Level Policy Change | 0 | none | STIG, Microsoft |
| 4960IPsec dropped an inbound packet that failed an integrity check. If this problem persists, it could indicate a network issue or that packets are being modified in transit to this computer. Verify that the packets sent from the remote computer are the same as those received by this computer. This error might also indicate interoperability problems with other IPsec implementations. | Advanced Audit Policy: System > Audit IPsec Driver | 0 | none | STIG, Microsoft |
| 4961IPsec dropped an inbound packet that failed a replay check. If this problem persists, it could indicate a replay attack against this computer. | Advanced Audit Policy: System > Audit IPsec Driver | 0 | none | STIG, Microsoft |
| 4962IPsec dropped an inbound packet that failed a replay check. The inbound packet had too low a sequence number to ensure it was not a replay. | Advanced Audit Policy: System > Audit IPsec Driver | 0 | none | STIG, Microsoft |
| 4963IPsec dropped an inbound clear text packet that should have been secured. This is usually due to the remote computer changing its IPsec policy without informing this computer. This could also be a spoofing attack attempt. | Advanced Audit Policy: System > Audit IPsec Driver | 0 | none | STIG, Microsoft |
| 4964Special groups have been assigned to a new logon. | Advanced Audit Policy: Logon/Logoff > Audit Special Logon | 0 | none | STIG, Microsoft |
| 4965IPsec received a packet from a remote computer with an incorrect Security Parameter Index (SPI). This is usually caused by malfunctioning hardware that is corrupting packets. If these errors persist, verify that the packets sent from the remote computer are the same as those received by this computer. This error may also indicate interoperability problems with other IPsec implementations. In that case, if connectivity is not impeded, then these events can be ignored. | Advanced Audit Policy: System > Audit IPsec Driver | 0 | none | STIG, Microsoft |
| 4976During Main Mode negotiation, IPsec received an invalid negotiation packet. If this problem persists, it could indicate a network issue or an attempt to modify or replay this negotiation. | Advanced Audit Policy: Logon/Logoff > Audit IPsec Main Mode | 0 | none | Microsoft |
| 4977During Quick Mode negotiation, IPsec received an invalid negotiation packet. If this problem persists, it could indicate a network issue or an attempt to modify or replay this negotiation. | Advanced Audit Policy: Logon/Logoff > Audit IPsec Quick Mode | 0 | none | Microsoft |
| 4978During Extended Mode negotiation, IPsec received an invalid negotiation packet. If this problem persists, it could indicate a network issue or an attempt to modify or replay this negotiation. | Advanced Audit Policy: Logon/Logoff > Audit IPsec Extended Mode | 0 | none | Microsoft |
| 4983An IPsec Extended Mode negotiation failed. The corresponding Main Mode security association has been deleted. | Advanced Audit Policy: Logon/Logoff > Audit IPsec Extended Mode | 0 | none | Microsoft |
| 4984An IPsec Extended Mode negotiation failed. The corresponding Main Mode security association has been deleted. | Advanced Audit Policy: Logon/Logoff > Audit IPsec Extended Mode | 0 | none | Microsoft |
| 4985The state of a transaction has changed. | Advanced Audit Policy: Object Access > Audit File System | 0 | none | STIG, Microsoft |
| 5024The Windows Firewall Service has started successfully. | Advanced Audit Policy: System > Audit Other System Events | 0 | none | STIG, Microsoft |
| 5025The Windows Firewall Service has been stopped. | Advanced Audit Policy: System > Audit Other System Events | 0 | none | STIG, Microsoft |
| 5027The Windows Firewall Service was unable to retrieve the security policy from the local storage. The service will continue enforcing the current policy. | Advanced Audit Policy: System > Audit Other System Events | 0 | none | STIG, Microsoft |
| 5028The Windows Firewall Service was unable to parse the new security policy. The service will continue with currently enforced policy. | Advanced Audit Policy: System > Audit Other System Events | 0 | none | STIG, Microsoft |
| 5029The Windows Firewall Service failed to initialize the driver. The service will continue to enforce the current policy. | Advanced Audit Policy: System > Audit Other System Events | 0 | none | STIG, Microsoft |
| 5030The Windows Firewall Service failed to start. | Advanced Audit Policy: System > Audit Other System Events | 0 | none | STIG, Microsoft |
| 5031The Windows Firewall Service blocked an application from accepting incoming connections on the network. | Advanced Audit Policy: Object Access > Audit Filtering Platform Connection | 0 | none | Microsoft |
| 5032Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network. | Advanced Audit Policy: System > Audit Other System Events | 0 | none | STIG, Microsoft |
| 5033The Windows Firewall Driver has started successfully. | Advanced Audit Policy: System > Audit Other System Events | 0 | none | STIG, Microsoft |
| 5034The Windows Firewall Driver has been stopped. | Advanced Audit Policy: System > Audit Other System Events | 0 | none | STIG, Microsoft |
| 5035The Windows Firewall Driver failed to start. | Advanced Audit Policy: System > Audit Other System Events | 0 | none | STIG, Microsoft |
| 5037The Windows Firewall Driver detected critical runtime error. Terminating. | Advanced Audit Policy: System > Audit Other System Events | 0 | none | STIG, Microsoft |
| 5038Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error. | Advanced Audit Policy: System > Audit System Integrity | 0 | Sigma 1 | STIG, NSA, Microsoft |
| 5039A registry key was virtualized. | Advanced Audit Policy: Object Access > Audit Registry | 0 | none | STIG, Microsoft |
| 5051A file was virtualized. | Advanced Audit Policy: Object Access > Audit File System | 0 | none | STIG, Microsoft |
| 5056A cryptographic self test was performed. | Advanced Audit Policy: System > Audit System Integrity | 0 | none | STIG, Microsoft |
| 5057A cryptographic primitive operation failed. | Advanced Audit Policy: System > Audit System Integrity | 0 | none | STIG, Microsoft |
| 5058Key file operation. | Advanced Audit Policy: System > Audit Other System Events | 0 | Microsoft Sentinel 1 | STIG, Microsoft |
| 5059Key migration operation. | Advanced Audit Policy: System > Audit Other System Events | 0 | Microsoft Sentinel 1 | STIG, Microsoft |
| 5060Verification operation failed. | Advanced Audit Policy: System > Audit System Integrity | 0 | none | STIG, Microsoft |
| 5061Cryptographic operation. | Advanced Audit Policy: System > Audit System Integrity | 0 | none | STIG, Microsoft |
| 5062A kernel-mode cryptographic self test was performed. | Advanced Audit Policy: System > Audit System Integrity | 0 | none | STIG, Microsoft |
| 5063A cryptographic provider operation was attempted. | Advanced Audit Policy: Policy Change > Audit Other Policy Change Events | 0 | none | STIG, Microsoft |
| 5064A cryptographic context operation was attempted. | Advanced Audit Policy: Policy Change > Audit Other Policy Change Events | 0 | none | STIG, Microsoft |
| 5065A cryptographic context modification was attempted. | Advanced Audit Policy: Policy Change > Audit Other Policy Change Events | 0 | none | STIG, Microsoft |
| 5066A cryptographic function operation was attempted. | Advanced Audit Policy: Policy Change > Audit Other Policy Change Events | 0 | none | STIG, Microsoft |
| 5067A cryptographic function modification was attempted. | Advanced Audit Policy: Policy Change > Audit Other Policy Change Events | 0 | none | STIG, Microsoft |
| 5068A cryptographic function provider operation was attempted. | Advanced Audit Policy: Policy Change > Audit Other Policy Change Events | 0 | none | STIG, Microsoft |
| 5069A cryptographic function property operation was attempted. | Advanced Audit Policy: Policy Change > Audit Other Policy Change Events | 0 | none | STIG, Microsoft |
| 5070A cryptographic function property modification was attempted. | Advanced Audit Policy: Policy Change > Audit Other Policy Change Events | 0 | none | STIG, Microsoft |
| 5120OCSP Responder Service Started. | | 0 | none | Microsoft |
| 5121OCSP Responder Service Stopped. | | 0 | none | Microsoft |
| 5122A configuration entry changed in OCSP Responder Service. | | 0 | none | Microsoft |
| 5123A configuration entry changed in OCSP Responder Service. | | 0 | none | Microsoft |
| 5124A security setting was updated on the OCSP Responder Service. | | 0 | none | Microsoft |
| 5137A directory service object was created. | Advanced Audit Policy: DS Access > Audit Directory Service Changes | 0 | Splunk 4, Sigma 1, Elastic 5, Microsoft Sentinel 5 | STIG, NSA, Microsoft |
| 5138A directory service object was undeleted. | Advanced Audit Policy: DS Access > Audit Directory Service Changes | 0 | Microsoft Sentinel 1 | STIG, NSA, Microsoft |
| 5139A directory service object was moved. | Advanced Audit Policy: DS Access > Audit Directory Service Changes | 0 | Microsoft Sentinel 1 | STIG, NSA, Microsoft |
| 5141A directory service object was deleted. | Advanced Audit Policy: DS Access > Audit Directory Service Changes | 0 | Splunk 1, Microsoft Sentinel 2 | STIG, NSA, Microsoft |
| 5142Network Share Created | Advanced Audit Policy: Object Access > Audit File Share | 0 | none | STIG, NSA |
| 5143 | Advanced Audit Policy: Object Access > Audit File Share | 0 | Microsoft Sentinel 1 | STIG |
| 5144Network Share Deleted | Advanced Audit Policy: Object Access > Audit File Share | 0 | none | STIG, NSA |
| 5148 | Advanced Audit Policy: Object Access > Audit Other Object Access Events | 0 | none | STIG |
| 5149 | Advanced Audit Policy: Object Access > Audit Other Object Access Events | 0 | none | STIG |
| 5150 | Advanced Audit Policy: Object Access > Audit Filtering Platform Connection | 0 | none | |
| 5151 | Advanced Audit Policy: Object Access > Audit Filtering Platform Connection | 0 | none | |
| 5154The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections. | Advanced Audit Policy: Object Access > Audit Filtering Platform Connection | 0 | none | Microsoft |
| 5155The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections. | Advanced Audit Policy: Object Access > Audit Filtering Platform Connection | 0 | none | Microsoft |
| 5158The Windows Filtering Platform has permitted a bind to a local port. | Advanced Audit Policy: Object Access > Audit Filtering Platform Connection | 0 | none | Microsoft |
| 5159The Windows Filtering Platform has blocked a bind to a local port. | Advanced Audit Policy: Object Access > Audit Filtering Platform Connection | 0 | none | Microsoft |
| 5168 | Advanced Audit Policy: Object Access > Audit File Share | 0 | none | STIG |
| 5376Credential Manager credentials were backed up. | Advanced Audit Policy: Account Management > Audit User Account Management | 0 | none | STIG, NSA, Microsoft |
| 5377Credential Manager credentials were restored from a backup. | Advanced Audit Policy: Account Management > Audit User Account Management | 0 | none | STIG, NSA, Microsoft |
| 5378The requested credentials delegation was disallowed by policy. | Advanced Audit Policy: Logon/Logoff > Audit Other Logon/Logoff Events | 0 | none | STIG, Microsoft |
| 5447A Windows Filtering Platform filter has been changed. | Advanced Audit Policy: Policy Change > Audit Other Policy Change Events | 0 | Splunk 2, Sigma 2 | STIG, Microsoft |
| 5453An IPsec negotiation with a remote computer failed because the IKE and AuthIP IPsec Keying Modules (IKEEXT) service is not started. | Advanced Audit Policy: Logon/Logoff > Audit IPsec Main Mode | 0 | none | Microsoft |
| 5478IPsec Services has started successfully. | Advanced Audit Policy: System > Audit IPsec Driver | 0 | none | STIG, Microsoft |
| 5479IPsec Services has been shut down successfully. The shutdown of IPsec Services can put the computer at greater risk of network attack or expose the computer to potential security risks. | Advanced Audit Policy: System > Audit IPsec Driver | 0 | none | STIG, Microsoft |
| 5480IPsec Services failed to get the complete list of network interfaces on the computer. This poses a potential security risk because some of the network interfaces may not get the protection provided by the applied IPsec filters. Use the IP Security Monitor snap-in to diagnose the problem. | Advanced Audit Policy: System > Audit IPsec Driver | 0 | none | STIG, Microsoft |
| 5483IPsec Services failed to initialize RPC server. IPsec Services could not be started. | Advanced Audit Policy: System > Audit IPsec Driver | 0 | none | STIG, Microsoft |
| 5484IPsec Services has experienced a critical failure and has been shut down. The shutdown of IPsec Services can put the computer at greater risk of network attack or expose the computer to potential security risks. | Advanced Audit Policy: System > Audit IPsec Driver | 0 | none | STIG, Microsoft |
| 5485IPsec Services failed to process some IPsec filters on a plug-and-play event for network interfaces. This poses a potential security risk because some of the network interfaces may not get the protection provided by the applied IPsec filters. Use the IP Security Monitor snap-in to diagnose the problem. | Advanced Audit Policy: System > Audit IPsec Driver | 0 | none | STIG, Microsoft |
| 5632A request was made to authenticate to a wireless network. | Advanced Audit Policy: Logon/Logoff > Audit Other Logon/Logoff Events | 0 | none | STIG, NSA, Microsoft |
| 5633A request was made to authenticate to a wired network. | Advanced Audit Policy: Logon/Logoff > Audit Other Logon/Logoff Events | 0 | none | STIG, Microsoft |
| 5827The Netlogon service denied a vulnerable Netlogon secure channel connection from a machine account. | | 0 | none | Microsoft |
| 5828The Netlogon service denied a vulnerable Netlogon secure channel connection using a trust account. | | 0 | none | Microsoft |
| 5888An object in the COM+ Catalog was modified. | Advanced Audit Policy: Object Access > Audit Other Object Access Events | 0 | none | STIG, Microsoft |
| 5889An object was deleted from the COM+ Catalog. | Advanced Audit Policy: Object Access > Audit Other Object Access Events | 0 | none | STIG, Microsoft |
| 5890An object was added to the COM+ Catalog. | Advanced Audit Policy: Object Access > Audit Other Object Access Events | 0 | none | STIG, Microsoft |
| 6144Security policy in the Group Policy objects has been applied successfully. | Advanced Audit Policy: Policy Change > Audit Other Policy Change Events | 0 | none | STIG, Microsoft |
| 6145One or more errors occurred while processing security policy in the Group Policy objects. | Advanced Audit Policy: Policy Change > Audit Other Policy Change Events | 0 | none | STIG, Microsoft |
| 6281Detected an invalid page hash of an image file | Advanced Audit Policy: System > Audit System Integrity | 0 | Sigma 1 | STIG, NSA |
| 6400 | Advanced Audit Policy: System > Audit Other System Events | 0 | none | STIG |
| 6401 | Advanced Audit Policy: System > Audit Other System Events | 0 | none | STIG |
| 6402 | Advanced Audit Policy: System > Audit Other System Events | 0 | none | STIG |
| 6403 | Advanced Audit Policy: System > Audit Other System Events | 0 | none | STIG |
| 6404 | Advanced Audit Policy: System > Audit Other System Events | 0 | none | STIG |
| 6405 | Advanced Audit Policy: System > Audit Other System Events | 0 | none | STIG |
| 6406 | Advanced Audit Policy: System > Audit Other System Events | 0 | none | STIG |
| 6407 | Advanced Audit Policy: System > Audit Other System Events | 0 | none | STIG |
| 6408 | Advanced Audit Policy: System > Audit Other System Events | 0 | none | STIG |
| 6409 | Advanced Audit Policy: System > Audit Other System Events | 0 | none | STIG |
| 6410 | Advanced Audit Policy: System > Audit System Integrity | 0 | none | STIG |
| 6419 | Advanced Audit Policy: Detailed Tracking > Audit PNP Activity | 0 | none | STIG |
| 6420 | Advanced Audit Policy: Detailed Tracking > Audit PNP Activity | 0 | none | STIG |
| 6421 | Advanced Audit Policy: Detailed Tracking > Audit PNP Activity | 0 | none | STIG |
| 6422 | Advanced Audit Policy: Detailed Tracking > Audit PNP Activity | 0 | none | STIG |
| 6423 | Advanced Audit Policy: Detailed Tracking > Audit PNP Activity | 0 | Sigma 1 | STIG |
| 6424 | Advanced Audit Policy: Detailed Tracking > Audit PNP Activity | 0 | none | STIG |
| 24586An error was encountered converting volume. | | 0 | none | Microsoft |
| 24592An attempt to automatically restart conversion on volume %2 failed. | | 0 | none | Microsoft |
| 24593Metadata write: Volume %2 returning errors while trying to modify metadata. If failures continue, decrypt volume. | | 0 | none | Microsoft |
| 24594Metadata rebuild: An attempt to write a copy of metadata on volume %2 failed and may appear as disk corruption. If failures continue, decrypt volume. | | 0 | none | Microsoft |