/resourcesreferencesecurity2000.htm" />

Please enable JavaScript to view this site.

Navigation: Additional Tips and Resources > Event Log Reference > Security Events > Legacy Operating Systems

Windows 2000 Security Events

Scroll Prev Top Next More

Windows 2000 security event descriptions from the security event log. These events will appear with the security event source.  Most of of the event descriptions listed here also apply to Windows XP and Windows Server 2003.

 

  Event ID: 512 (0x0200)

      Type: Success Audit

Description: Windows NT is starting up.

 

  Event ID: 513 (0x0201)

      Type: Success Audit

Description: Windows NT is shutting down.

            All logon sessions will be terminated by this shutdown.

 

  Event ID: 514 (0x0202)

      Type: Success Audit

Description: An authentication package has been loaded by the Local Security Authority.

            This authentication package will be used to authenticate logon attempts.

            Authentication Package Name: %1

 

  Event ID: 515 (0x0203)

      Type: Success Audit

Description: A trusted logon process has registered with the Local Security Authority.

            This logon process will be trusted to submit logon requests.

            Logon Process Name: %1

 

  Event ID: 516 (0x0204)

      Type: Success Audit

Description: Internal resources allocated for the queuing of audit messages have been

            exhausted, leading to the loss of some audits.

            Number of audit messages discarded: %1

 

  Event ID: 517 (0x0205)

      Type: Success Audit

Description: The audit log was cleared

            Primary User Name: %1     Primary Domain:   %2

            Primary Logon ID:  %3     Client User Name: %4

            Client Domain:     %5     Client Logon ID:  %6

 

  Event ID: 518 (0x0206)

      Type: Success Audit

Description: An notification package has been loaded by the Security Account Manager.

            This package will be notified of any account or password changes.

            Notification Package Name: %1

 

  Event ID: 528 (0x0210)

      Type: Success Audit

Description: Successful Logon:

            User Name: %1             Domain: %2

            Logon ID: %3              Logon Type: %4

            Logon Process: %5         Authentication Package: %6

            Workstation Name: %7

 

  Event ID: 529 (0x0211)

      Type: Failure Audit

Description: Logon Failure

            Reason: Unknown user name or bad password

            User Name: %1              Domain: %2

            Logon Type: %3             Logon Process: %4

            Authentication Package: %5 Workstation Name: %6

 

  Event ID: 530 (0x0212)

      Type: Failure Audit

Description: Logon Failure

            Reason: Account logon time restriction violation

            User Name: %1              Domain: %2

            Logon Type: %3             Logon Process: %4

            Authentication Package: %5 Workstation Name: %6

 

  Event ID: 531 (0x0213)

      Type: Failure Audit

Description: Logon Failure

            Reason: Account currently disabled

            User Name: %1              Domain: %2

            Logon Type: %3             Logon Process: %4

            Authentication Package: %5 Workstation Name: %6

 

  Event ID: 532 (0x0214)

      Type: Failure Audit

Description: Logon Failure

            Reason: The specified user account has expired

            User Name: %1              Domain: %2

            Logon Type: %3             Logon Process: %4

            Authentication Package: %5 Workstation Name: %6

 

  Event ID: 533 (0x0215)

      Type: Failure Audit

Description: Logon Failure

            Reason: User not allowed to logon at this computer

            User Name: %1              Domain: %2

            Logon Type: %3             Logon Process: %4

            Authentication Package: %5 Workstation Name: %6

 

  Event ID: 534 (0x0216)

      Type: Failure Audit

Description: Logon Failure

            Reason:The user has not been granted the requested

            logon type at this machine

            User Name: %1              Domain: %2

            Logon Type: %3             Logon Process: %4

            Authentication Package: %5 Workstation Name: %6

 

  Event ID: 535 (0x0217)

      Type: Failure Audit

Description: Logon Failure

            Reason: The specified account's password has expired

            User Name: %1              Domain: %2

            Logon Type: %3             Logon Process: %4

            Authentication Package: %5 Workstation Name: %6

 

  Event ID: 536 (0x0218)

      Type: Failure Audit

Description: Logon Failure

            Reason: The NetLogon component is not active

            User Name: %1              Domain: %2

            Logon Type: %3             Logon Process: %4

            Authentication Package: %5 Workstation Name: %6

 

  Event ID: 537 (0x0219)

      Type: Failure Audit

Description: Logon Failure

            Reason: An unexpected error occurred during logon

            User Name: %1              Domain: %2

            Logon Type: %3             Logon Process: %4

            Authentication Package: %5 Workstation Name: %6

 

  Event ID: 538 (0x021A)

      Type: Success Audit

Description: User Logoff

            User Name: %1              Domain: %2

            Logon ID: %3               Logon Type: %4.

 

  Event ID: 539 (0x021B)

      Type: Failure Audit

Description: Logon Failure

            Reason: Account locked out

            User Name: %1              Domain: %2

            Logon Type: %3             Logon Process: %4

            Authentication Package: %5 Workstation Name: %6

 

  Event ID: 540 (0x021c)

      Type: Success Audit

Description: Successful Network Logon

            User Name: %1              Domain: %2

            Logon ID: %3               Logon Type: %4

            Logon Process: %5          Authentication Package: %6

            Workstation Name: %7

 

  Event ID: 541 (0x021d)

      Type: Success Audit

Description: IKE security association established.

            Mode: %1                   Peer Identity: %2

            Filter: %3                 Parameters: %4

 

  Event ID: 542 (0x021e)

      Type: Success Audit

Description: IKE security association ended.

            Mode: Data Protection (Quick mode)

            Filter: %1                 Inbound SPI: %2

            Outbound SPI: %3

 

  Event ID: 543 (0x021f)

      Type: Success Audit

Description: IKE security association ended.

            Mode: Key Exchange (Main mode)

            Filter: %1

 

  Event ID: 544 (0x0220)

      Type: Failure Audit

Description: IKE security association establishment failed because peer could not

            authenticate. The certificate trust could not be established.

            Peer Identity: %1          Filter: %2

 

  Event ID: 545 (0x0221)

      Type: Failure Audit

Description: IKE peer authentication failed.

            Peer Identity: %1          Filter: %2

 

  Event ID: 546 (0x0222)

      Type: Failure Audit

Description: IKE security association establishment failed because peer

            sent invalid proposal.

            Mode: %1                   Filter: %2

            Attribute: %3              Expected value: %4

            Received value: %5

 

  Event ID: 547 (0x0223)

      Type: Failure Audit

Description: IKE security association negotiation failed.

            Mode:          %1          Filter: %2

            Failure Point: %3          Failure Reason: %4

 

  Event ID: 560 (0x0230)

      Type: Success Audit

Description: Object Open

            Object Server: %1          Object Type: %2

            Object Name: %3            New Handle ID: %4

            Operation ID:{%5,%6}       Process ID: %7

            Primary User Name: %8      Primary Domain: %9

            Primary Logon ID: %10      Client User Name: %11

            Client Domain: %12         Client Logon ID: %13

            Accesses %14               Privileges %15

 

  Event ID: 561 (0x0231)

      Type: Success Audit

Description: Handle Allocated

            Handle ID: %1              Operation ID:{%2,%3}

            Process ID: %4

 

  Event ID: 562 (0x0232)

      Type: Success Audit

Description: Handle Closed

            Object Server: %1          Handle ID: %2

            Process ID: %3

 

  Event ID: 563 (0x0233)

      Type: Success Audit

Description: Object Open for Delete

            Object Server: %1          Object Type: %2

            Object Name: %3            New Handle ID: %4

            Operation ID:{%5,%6}       Process ID: %7

            Primary User Name: %8      Primary Domain: %9

            Primary Logon ID: %10      Client User Name: %11

            Client Domain: %12         Client Logon ID: %13

            Accesses %14               Privileges %15

 

  Event ID: 564 (0x0234)

      Type: Success Audit

Description: Object Deleted

            Object Server: %1          Handle ID: %2

            Process ID: %3

 

  Event ID: 565 (0x0235)

      Type: Success Audit

Description: Object Open

            Object Server: %1          Object Type: %2

            Object Name: %3            New Handle ID: %4

            Operation ID:{%5,%6}       Process ID: %7

            Primary User Name: %8      Primary Domain: %9

            Primary Logon ID: %10      Client User Name: %11

            Client Domain: %12         Client Logon ID: %13

            Accesses %14               Privileges %15

            Properties:%16%17%18%19%20%21%22%23%24%25

 

  Event ID: 566 (0x0236)

      Type: Success Audit

Description: Object Operation

            Operation Type %1          Object Type: %2

            Object Name: %3            Handle ID: %4

            Operation ID:{%5,%6}       Primary User Name: %7

            Primary Domain: %8         Primary Logon ID: %9

            Client User Name: %10      Client Domain: %11

            Client Logon ID: %12       Requested Accesses %13

 

  Event ID: 576 (0x0240)

      Type: Success Audit

Description: Special privileges assigned to new logon:

            User Name: %1              Domain: %2

            Logon ID: %3               Assigned: %4

 

  Event ID: 577 (0x0241)

      Type: Success Audit

Description: Privileged Service Called

            Server: %1                 Service: %2

            Primary User Name: %3      Primary Domain: %4

            Primary Logon ID: %5       Client User Name: %6

            Client Domain: %7          Client Logon ID: %8

            Privileges: %9

 

  Event ID: 578 (0x0242)

      Type: Success Audit

Description: Privileged object operation

            Object Server: %1          Object Handle: %2

            Process ID: %3             Primary User Name: %4

            Primary Domain: %5         Primary Logon ID: %6

            Client User Name: %7       Client Domain: %8

            Client Logon ID: %9        Privileges: %10

 

  Event ID: 592 (0x0250)

      Type: Success Audit

Description: A new process has been created

            New Process ID: %1         Image File Name: %2

            Creator Process ID: %3     User Name: %4

            Domain: %5                 Logon ID: %6

 

  Event ID: 593 (0x0251)

      Type: Success Audit

Description: A process has exited

            Process ID: %1             User Name: %2

            Domain: %3                 Logon ID: %4

 

  Event ID: 594 (0x0252)

      Type: Success Audit

Description: A handle to an object has been duplicated

            Source Handle ID: %1       Source Process ID: %2

            Target Handle ID: %3       Target Process ID: %4

 

  Event ID: 595 (0x0253)

      Type: Success Audit

Description: Indirect access to an object has been obtained

            Object Type: %1            Object Name: %2

            Process ID: %3             Primary User Name: %4

            Primary Domain: %5         Primary Logon ID: %6

            Client User Name: %7       Client Domain: %8

            Client Logon ID: %9        Accesses: %10

 

  Event ID: 608 (0x0260)

      Type: Success Audit

Description: User Right Assigned

            User Right: %1             Assigned To: %2

Assigned By  User Name: %3              Domain: %4

            Logon ID: %5

 

  Event ID: 609 (0x0261)

      Type: Success Audit

Description: User Right Removed

            User Right: %1             Removed From: %2

Removed By:  User Name: %3              Domain: %4

            Logon ID: %5

 

  Event ID: 610 (0x0262)

      Type: Success Audit

Description: New Trusted Domain        

            Domain Name: %1            Domain ID: %2

Established By:  

            User Name: %3              Domain: %4

            Logon ID: %5

 

  Event ID: 611 (0x0263)

      Type: Success Audit

Description: Removing Trusted Domain

            Domain Name: %1            Domain ID: %2

Removed By:  User Name: %3              Domain: %4

            Logon ID: %5

 

  Event ID: 612 (0x0264)

      Type: Success Audit

Description: Audit Policy Change

            New Policy:

            Success   Failure

              %1         %2    System

              %3         %4    Logon/Logoff

              %5         %6    Object Access

              %7         %8    Privilege Use

              %9        %10    Detailed Tracking

             %11        %12    Policy Change

             %13        %14    Account Management

            Changed By:

            User Name: %15             Domain Name: %16

            Logon ID: %17

 

  Event ID: 613 (0x0265)

      Type: Success Audit

Description: IPSec policy agent started  

            Ipsec Policy Agent: %1     Policy Source:  %2

            Event Data: %3

 

  Event ID: 614 (0x0266)

      Type: Success Audit

Description: IPSec policy agent disabled

            Ipsec Policy Agent: %1     Event Data:  %2

 

  Event ID: 615 (0x0267)

      Type: Success Audit

Description: IPSEC PolicyAgent Service:  %1

            Event Data: %1

 

  Event ID: 616 (0x0268)

      Type: Failure Audit

Description: IPSec policy agent encountered a potentially serious failure.

            Event Data: %1

 

  Event ID: 617 (0x0269)

      Type: Success Audit

Description: Kerberos Policy Changed

Changed By:  User Name: %1              Domain Name: %2

            Logon ID: %3              

          Changes made: %4

         

          '-'  means no changes, otherwise each change is shown as:

          Parameter Name: (new value) (old value)

 

  Event ID: 618 (0x026a)

      Type: Success Audit

Description: Encrypted Data Recovery Policy Changed

Changed By:  User Name: %1              Domain Name: %2

            Logon ID: %3              

          Changes made: %4

 

          '-'  means no changes, otherwise each change is shown as:

          Parameter Name: new value (old value)

 

  Event ID: 619 (0x026b)

      Type: Success Audit

Description: Quality of Service Policy Changed

Changed By:  User Name: %1              Domain Name: %2

            Logon ID: %3              

          Changes made: %4

 

          '-'  means no changes, otherwise each change is shown as:

          Parameter Name: new value (old value)

 

  Event ID: 620 (0x026C)

Description: Trusted Domain Information Modified:

            Domain Name: %1            Domain ID: %2

Modified By: User Name: %3              Domain: %4

            Logon ID: %5

 

  Event ID: 624 (0x0270)

      Type: Success Audit

Description: User Account Created

            New Account Name: %1       New Domain: %2

            New Account ID: %3

            Caller User Name: %4       Caller Domain: %5

            Caller Logon ID: %6        Privileges %7

 

  Event ID: 625 (0x0271)

Description: User Account Type Change

      Type: Success Audit

            Target Account Name: %1    Target Domain: %2

            Target Account ID: %3

            New Type: %4               Caller User Name: %5

            Caller Domain: %6          Caller Logon ID: %7

 

  Event ID: 626 (0x0272)

Description: User Account Enabled

      Type: Success Audit

            Target Account Name: %1    Target Domain: %2

            Target Account ID: %3

            Caller User Name: %4       Caller Domain: %5

            Caller Logon ID: %6

 

          Note: Windows 2000 does not log event ID 626 explicitly.

          Results are logged as a part of event ID 642 in the description of the message.

 

  Event ID: 627 (0x0273)

      Type: Success Audit

Description: Change Password Attempt

            Target Account Name: %1    Target Domain: %2

            Target Account ID: %3

            Caller User Name: %4       Caller Domain: %5

            Caller Logon ID: %6        Privileges: %7

 

  Event ID: 628 (0x0274)

      Type: Success Audit

Description: User Account password set

            Target Account Name: %1    Target Domain: %2

            Target Account ID: %3

            Caller User Name: %4       Caller Domain: %5

            Caller Logon ID: %6

 

  Event ID: 630 (0x0276)

      Type: Success Audit

Description: User Account Deleted:

            Target Account Name: %1    Target Domain: %2

            Target Account ID: %3

            Caller User Name: %4       Caller Domain: %5

            Caller Logon ID: %6        Privileges: %7

 

  Event ID: 631 (0x0277)

      Type: Success Audit

Description: Security Enabled Global Group Created

            New Account Name: %1       New Domain: %2

            New Account ID: %3

            Caller User Name: %4       Caller Domain: %5

            Caller Logon ID: %6        Privileges: %7

 

  Event ID: 632 (0x0278)

      Type: Success Audit

Description: Security Enabled Global Group Member Added

            Member Name: %1            Member ID: %2

            Target Account Name: %3    Target Domain: %4

            Target Account ID: %5

            Caller User Name: %6       Caller Domain: %7

            Caller Logon ID: %8        Privileges: %9

 

  Event ID: 633 (0x0279)

      Type: Success Audit

Description: Security Enabled Global Group Member Removed

            Member Name: %1            Member ID: %2

            Target Account Name: %3    Target Domain: %4

            Target Account ID: %5

            Caller User Name: %6       Caller Domain: %7

            Caller Logon ID: %8        Privileges: %9

 

  Event ID: 634 (0x027A)

      Type: Success Audit

Description: Security Enabled Global Group Deleted

            Target Account Name: %1    Target Domain: %2

            Target Account ID: %3

            Caller User Name: %4       Caller Domain: %5

            Caller Logon ID: %6        Privileges: %7

 

  Event ID: 635 (0x027B)

      Type: Success Audit

Description: Security Enabled Local Group Created

            New Account Name: %1       New Domain: %2

            New Account ID: %3

            Caller User Name: %4       Caller Domain: %5

            Caller Logon ID: %6        Privileges: %7

 

  Event ID: 636 (0x027C)

      Type: Success Audit

Description: Security Enabled Local Group Member Added

            Member Name: %1            Member ID: %2

            Target Account Name: %3    Target Domain: %4

            Target Account ID: %5

            Caller User Name: %6       Caller Domain: %7

            Caller Logon ID: %8        Privileges: %9

 

  Event ID: 637 (0x027D)

      Type: Success Audit

Description: Security Enabled Local Group Member Removed

            Member Name: %1            Member ID: %2

            Target Account Name: %3    Target Domain: %4

            Target Account ID: %5

            Caller User Name: %6       Caller Domain: %7

            Caller Logon ID: %8        Privileges: %9

 

  Event ID: 638 (0x027E)

      Type: Success Audit

Description: Security Enabled Local Group Deleted

            Target Account Name: %1    Target Domain: %2

            Target Account ID: %3

            Caller User Name: %4       Caller Domain: %5

            Caller Logon ID: %6        Privileges: %7

 

  Event ID: 639 (0x027F)

      Type: Success Audit

Description: Security Enabled Local Group Changed

            Target Account Name: %1    Target Domain: %2

            Target Account ID: %3

            Caller User Name: %4       Caller Domain: %5

            Caller Logon ID: %6        Privileges: %7

 

  Event ID: 640 (0x0280)

      Type: Success Audit

Description: General Account Database Change

            Type of change: %1         Object Type: %2

            Object Name: %3            Object ID: %4

            Caller User Name: %5       Caller Domain: %6

            Caller Logon ID: %7

 

  Event ID: 641 (0x0281)

      Type: Success Audit

Description: Security Enabled Global Group Changed

            Target Account Name: %1    Target Domain: %2

            Target Account ID: %3

            Caller User Name: %4       Caller Domain: %5

            Caller Logon ID: %6        Privileges: %7

 

  Event ID: 642 (0x0282)

      Type: Success Audit

Description: User Account Changed

            Target Account Name: %1    Target Domain: %2

            Target Account ID: %3

            Caller User Name: %4       Caller Domain: %5

            Caller Logon ID: %6        Privileges: %7

 

  Event ID: 643 (0x0283)

      Type: Success Audit

Description: Domain Policy Changed: %1 modified

            Domain: %2                 Domain ID: %3

            Caller User Name: %4       Caller Domain: %5

            Caller Logon ID: %6        Privileges: %7

 

  Event ID: 644 (0x0284)

      Type: Success Audit

Description: User Account Locked Out

            Target Account Name: %1    Target Account ID: %3

            Caller Machine Name: %2

            Caller User Name: %4       Caller Domain: %5

            Caller Logon ID: %6

 

  Event ID: 645 (0x0285)

      Type: Success Audit

Description: Computer Account Created

            New Account Name: %1       New Domain: %2

            New Account ID: %3

            Caller User Name: %4       Caller Domain: %5

            Caller Logon ID: %6        Privileges %7

 

  Event ID: 646 (0x0286)

      Type: Success Audit

Description: Computer Account Changed

            Target Account Name: %1    Target Domain: %2

            Target Account ID: %3

            Caller User Name: %5       Caller Domain: %6

            Caller Logon ID: %7        Privileges: %8

 

  Event ID: 647 (0x0287)

      Type: Success Audit

Description: Computer Account Deleted

            Target Account Name: %1    Target Domain: %2

            Target Account ID: %3

            Caller User Name: %4       Caller Domain: %5

            Caller Logon ID: %6        Privileges: %7

 

  Event ID: 648 (0x0288)

      Type: Success Audit

Description: Security Disabled Local Group Created

            Target Account Name: %1    Target Domain: %2

            Target Account ID: %3

            Caller User Name: %4       Caller Domain: %5

            Caller Logon ID: %6        Privileges: %7

 

  Event ID: 649 (0x0289)

      Type: Success Audit

Description: Security Disabled Local Group Changed

            Target Account Name: %1    Target Domain: %2

            Target Account ID: %3

            Caller User Name: %4       Caller Domain: %5

            Caller Logon ID: %6        Privileges: %7

 

  Event ID: 650 (0x028A)

      Type: Success Audit

Description: Security Disabled Local Group Member Added

            Member Name: %1            Member ID: %2

            Target Account Name: %3    Target Domain: %4

            Target Account ID: %5

            Caller User Name: %6       Caller Domain: %7

            Caller Logon ID: %8        Privileges: %9

 

  Event ID: 651 (0x028B)

      Type: Success Audit

Description: Security Disabled Local Group Member Removed

            Member Name: %1            Member ID: %2

            Target Account Name: %3    Target Domain: %4

            Target Account ID: %5

            Caller User Name: %6       Caller Domain: %7

            Caller Logon ID: %8        Privileges: %9

 

  Event ID: 652 (0x028C)

      Type: Success Audit

Description: Security Disabled Local Group Deleted

            Target Account Name: %1    Target Domain: %2

            Target Account ID: %3

            Caller User Name: %4       Caller Domain: %5

            Caller Logon ID: %6        Privileges: %7

 

  Event ID: 653 (0x028D)

      Type: Success Audit

Description: Security Disabled Global Group Created

            New Account Name: %1       New Domain: %2

            New Account ID: %3

            Caller User Name: %4       Caller Domain: %5

            Caller Logon ID: %6        Privileges: %7

 

  Event ID: 654 (0x028E)

      Type: Success Audit

Description: Security Disabled Global Group Changed

            Target Account Name: %1    Target Domain: %2

            Target Account ID: %3

            Caller User Name: %4       Caller Domain: %5

            Caller Logon ID: %6        Privileges: %7

 

  Event ID: 655 (0x028F)

      Type: Success Audit

Description: Security Disabled Global Group Member Added

            Member Name: %1            Member ID: %2

            Target Account Name: %3    Target Domain: %4

            Target Account ID: %5

            Caller User Name: %6       Caller Domain: %7

            Caller Logon ID: %8        Privileges: %9

 

  Event ID: 656 (0x0290)

      Type: Success Audit

Description: Security Disabled Global Group Member Removed

            Member Name: %1            Member ID: %2

            Target Account Name: %3    Target Domain: %4

            Target Account ID: %5

            Caller User Name: %6       Caller Domain: %7

            Caller Logon ID: %8        Privileges: %9

 

  Event ID: 657 (0x0291)

      Type: Success Audit

Description: Security Disabled Global Group Deleted

            Target Account Name: %1    Target Domain: %2

            Target Account ID: %3

            Caller User Name: %4       Caller Domain: %5

            Caller Logon ID: %6        Privileges: %7

 

  Event ID: 658 (0x0292)

      Type: Success Audit

Description: Security Enabled Universal Group Created

            New Account Name: %1       New Domain: %2

            New Account ID: %3

            Caller User Name: %4       Caller Domain: %5

            Caller Logon ID: %6        Privileges: %7

 

  Event ID: 659 (0x0293)

      Type: Success Audit

Description: Security Enabled Universal Group Changed

            Target Account Name: %1    Target Domain: %2

            Target Account ID: %3

            Caller User Name: %4       Caller Domain: %5

            Caller Logon ID: %6        Privileges: %7

 

  Event ID: 660 (0x0294)

      Type: Success Audit

Description: Security Enabled Universal Group Member Added

            Member Name: %1            Member ID: %2

            Target Account Name: %3    Target Domain: %4

            Target Account ID: %5

            Caller User Name: %6       Caller Domain: %7

            Caller Logon ID: %8        Privileges: %9

 

  Event ID: 661 (0x0295)

      Type: Success Audit

Description: Security Enabled Universal Group Member Removed

            Member Name: %1            Member ID: %2

            Target Account Name: %3    Target Domain: %4

            Target Account ID: %5

            Caller User Name: %6       Caller Domain: %7

            Caller Logon ID: %8        Privileges: %9

 

  Event ID: 662 (0x0296)

      Type: Success Audit

Description: Security Enabled Universal Group Deleted

            Target Account Name: %1    Target Domain: %2

            Target Account ID: %3

            Caller User Name: %4       Caller Domain: %5

            Caller Logon ID: %6        Privileges: %7

 

  Event ID: 663 (0x0297)

      Type: Success Audit

Description: Security Disabled Universal Group Created

            New Account Name: %1       New Domain: %2

            New Account ID: %3

            Caller User Name: %4       Caller Domain: %5

            Caller Logon ID: %6        Privileges: %7

 

  Event ID: 664 (0x0298)

      Type: Success Audit

Description: Security Disabled Universal Group Changed

            Target Account Name: %1    Target Domain: %2

            Target Account ID: %3

            Caller User Name: %4       Caller Domain: %5

            Caller Logon ID: %6        Privileges: %7

 

  Event ID: 665 (0x0299)

      Type: Success Audit

Description: Security Disabled Universal Group Member Added

            Member Name: %1            Member ID: %2

            Target Account Name: %3    Target Domain: %4

            Target Account ID: %5

            Caller User Name: %6       Caller Domain: %7

            Caller Logon ID: %8        Privileges: %9

 

  Event ID: 666 (0x029A)

      Type: Success Audit

Description: Security Disabled Universal Group Member Removed

            Member Name: %1            Member ID: %2

            Target Account Name: %3    Target Domain: %4

            Target Account ID: %5

            Caller User Name: %6       Caller Domain: %7

            Caller Logon ID: %8        Privileges: %9

 

  Event ID: 667 (0x029B)

      Type: Success Audit

Description: Security Disabled Universal Group Deleted

            Target Account Name: %1    Target Domain: %2

            Target Account ID: %3

            Caller User Name: %4       Caller Domain: %5

            Caller Logon ID: %6        Privileges: %7

 

  Event ID: 668 (0x029C)

      Type: Success Audit

Description: Group Type Changed

            Target Account Name: %1    Target Domain: %2

            Target Account ID: %3

            Caller User Name: %5       Caller Domain: %6

            Caller Logon ID: %7        Privileges: %8

 

  Event ID: 669 (0x029D)

      Type: Success Audit

Description: Add SID History

            Source Account Name: %1    Source Account ID: %2

            Target Account Name: %3    Target Domain: %4

            Target Account ID: %5

            Caller User Name: %6       Caller Domain: %7

            Caller Logon ID: %8        Privileges: %9

 

  Event ID: 670 (0x029E)

      Type: Success Audit

Description: Add SID History

            Source Account Name: %1    Target Account Name: %2

            Target Domain: %3          Target Account ID: %4

            Caller User Name: %5       Caller Domain: %6

            Caller Logon ID: %7        Privileges: %8

 

  Event ID: 672 (0x02a0)

      Type: Success Audit

Description: Authentication Ticket Granted

            User Name: %1              Supplied Realm Name: %2

            User ID: %3                Service Name: %4

            Service ID: %5             Ticket Options: %6

            Ticket Encryption Type: %7 Pre-Authentication Type: %8

            Client Address: %9

 

  Event ID: 673 (0x02a1)

      Type: Success Audit

Description: Service Ticket Granted

            User Name: %1              User Domain: %2

            Service Name: %3           Service ID: %4

            Ticket Options: %5         Ticket Encryption Type: %6

            Client Address: %7

 

  Event ID: 674 (0x02a2)

      Type: Success Audit

Description: Ticket Granted Renewed

            User Name: %1              User Domain: %2

            Service Name: %3           Service ID: %4

            Ticket Options: %5         Ticket Encryption Type: %6

            Client Address: %7

 

  Event ID: 675 (0x02a3)

      Type: Failure Audit

Description: Pre-authentication failed

            User Name: %1              User ID: %2

            Service Name: %3           Pre-Authentication Type: %4

            Failure Code: %5           Client Address: %6

 

  Event ID: 676 (0x02a4)

      Type: Failure Audit

Description: Authentication Ticket Request Failed

            User Name: %1              Supplied Realm Name: %2

            Service Name: %3           Ticket Options: %4

            Failure Code: %5           Client Address: %6

 

  Event ID: 677 (0x02a5)

      Type: Failure Audit

Description: Service Ticket Request Failed:

Description: Authentication Ticket Request Failed

            User Name: %1              Supplied Realm Name: %2

            Service Name: %3           Ticket Options: %4

            Failure Code: %5           Client Address: %6

 

  Event ID: 678 (0x02a6)

      Type: Success Audit

Description: Account Mapped for Logon by: %1

            Client Name: %2            Mapped Name:%3

 

  Event ID: 679 (0x02a7)

      Type: Failure Audit

Description: The name: %2 could not be mapped for logon by: %1

 

  Event ID: 680 (0x02a8)

      Type: Success Audit

Description: Account Used for Logon by: %1

            Account Name: %2           Workstation: %3

 

  Event ID: 681 (0x02a9)

      Type: Failure Audit

Description: The logon to account: %2 by: %1 from workstation: %3 failed. The error code was: %4

 

  Event ID: 682 (0x02aa)

      Type: Success Audit

Description: Session reconnected to winstation:

            User Name: %1              Domain: %2

            Logon ID: %3               Session Name: %4

            Client Name: %5            Client Address: %6

 

  Event ID: 683 (0x02ab)

      Type: Success Audit

Description: Session disconnected from winstation:

            User Name: %1              Domain: %2

            Logon ID: %3               Session Name: %4

            Client Name: %5            Client Address: %6