Audit Categories

Audit event records are divided into auditing categories. These categories are displayed by Event Viewer and allow a user to visually distinguish or automatically filter audit events of interest.

For more information on a specific audit category, select one of the following topics.

  System Event Category

  Logon/Logoff Category

  Object Access Category

  Privilege Use Category

  Account Management Category

  Policy Change Category

  Detailed Tracking Category


System Event Category

Events in this category indicate that something affecting the security of the entire system or of the audit log has occurred

This section describes audit event records that belong to the System Event category.

Note:	If events in the System Event category are the only ones audited, records related to the audited events are not generated. To see these records be sure to specify the Logon/Logoff or Detailed Tracking categories when setting the audit policy.

For more information, select one of the following system event topics:

  System Restart

  System Shutdown

  Authentication Package Load

  Logon Process Registered

  Some Audit Event Records Discarded

  Audit Log Cleared


System Restart
System Event Category
System Restart

This event record indicates that the system has been rebooted. This has several implications:

All paired events (such as logon/logoff or open/close) from before the restart are terminated.

Some number of audit event records might have been lost. This is particularly true if a System Shutdown audit event record is not present in the log. This typically means that the system was powered off or crashed, rather than being shut down gracefully.

There is no event type-specific information for this event type.

Example Detailed View Text

Date:	9/8/92	Event ID:	512

Time:	10:32:11 AM	Source:	Security

User:	NT AUTHORITY\SYSTEM	Type:	Success Audit

Computer:	ACCTG	Category:	System

Description:
Windows NT is starting up.


System Shutdown
System Event Category
System Shutdown

This event record indicates that the system is being shut down in an orderly fashion. This is not a guarantee that the system successfully shut down before power was turned off or the system crashed, because once the system has shut down it cannot write the fact that it has shut down to the log.

There is no event type-specific information for this event type.

Example Detailed View Text

Date:	9/8/92	Event ID:	513

Time:	10:32:11 AM	Source:	Security

User:	NT AUTHORITY\SYSTEM	Type:	Success Audit

Computer:	ACCTG	Category:	System

Description:
Windows NT is shutting down.
All logon sessions will be terminated by this shutdown.


Authentication Package Load
System Event Category
Authentication Package Load

This event record indicates that the Local Security Authority has loaded an authentication package used for authenticating logon requests.

Authentication packages are responsible for validating user identification and authentication information collected by logon processes during logon. A single system can simultaneously support multiple authentication packages.

Example Detailed View Text

Date:	9/8/92	Event ID:	514

Time:	10:32:11 AM	Source:	Security

User:	NT AUTHORITY\SYSTEM	Type:	Success Audit

Computer:	ACCTG	Category:	System

Description:

An authentication package has been loaded by the Local Security Authority. This authentication package will be used to authenticate logon attempts.
Authentication Package:	msv1_0


Logon Process Registered
System Event Category
Logon Process Registered

This event record indicates that a logon process has registered with the Local Security Authority. Logon requests will now be accepted from this source.

Logon processes are trusted components responsible for collecting identification and authentication information from external devices, such as terminals and networks. They use Local Security Authority services to log these users on. A single system can simultaneously support multiple logon processes.

The event record data consists of the logon process name.

Example Detailed View Text

Date:	9/8/92	Event ID:	515

Time:	10:32:11 AM	Source:	Security

User:	NT AUTHORITY\SYSTEM	Type:	Success Audit

Computer:	ACCTG	Category:	System

Description:
A trusted logon process has registered with the Local Security Authority. This logon process will be trusted to submit logon requests.

Logon Process Name:	Winlogon


Some Audit Event Records Discarded
System Event Category
Some Audit Event Records Discarded

This event record indicates that audit event records have been discarded, due to overwriting of earlier records or due to cessation of auditing, depending on the audit policy you have established; or by internal event queues exceeding their maximum length.

The event record data consists of the number of audits discarded.

Example Detailed View Text

Date:	9/8/92	Event ID:	516

Time:	10:32:11 AM	Source:	Security

User:	NT AUTHORITY\SYSTEM	Type:	Success Audit

Computer:	ACCTG	Category:	System

Description:
Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits.

Number of audit messages discarded:	12


Audit Log Cleared
System Event Category
Audit Log Cleared

This event record indicates that the audit log has been cleared. This event is always recorded, regardless of the audit policy. It is recorded even if auditing is turned off.


Logon/Logoff Category

Events in this category describe a single successful or unsuccessful logon or logoff. Included in each logon description is an indication of what type of logon was requested/performed (for example, interactive, network, or service).

Event log records for the Logon/Logoff category include the following items:

Authentication Package

Domain

Logon ID

Logon Process

Logon Type

Reason

User Name

The Logon/Logoff category can contain the following events.  For more information, select an event topic.

  Successful Logon

  Unknown Username or Bad Password

  Account Currently Disabled

  Logon Type Restricted

  Password Expired

  Unsuccessful Logon

  User Logoff


Authentication Package

The system component that authenticates logon attempts. The standard Windows NT authentication package is MICROSOFT_AUTHENTICATION_PACKAGE_V1_0


Domain

The name of the computer. If the computer is a member of a Windows NT Server domain, this can also be the name of the domain containing the user’s account.


Logon ID

A unique session identifier given when a user is logged on.


Logon Process

The process submitting the logon/logoff request. For example, an interactive logon is requested by User32, and a network logon can be requested by NTLanMan.


Logon Type

Indicates the method of logging on. For example, a value of 2 indicates a normal interactive logon, and 3 indicates a remote (network) logon.


Reason

The cause of a failed logon or logoff attempt.


User Name

The username of the user who logged on or off.


Successful Logon
Logon/Logoff Category
Successful Logon

This event record indicates that a new logon has occurred. The account logged on to, the type of logon (such as interactive or network), and a unique ID representing this logon are recorded. The unique ID, called a logon ID or authentication ID, is subsequently used in other audit event records to tie them back to the particular logon session. This allows multiple logons to a single user account to be distinguished, which might assist in assessing damage from a security breach.

The event record description contains the following information:

User account name

Authenticating authority (domain)

String representation of authentication ID

Logon type

Logon process name

Authentication package name

Example Detailed View Text

Date:	9/8/92	Event ID:	528

Time:	10:32:11 AM	Source:	Security

User:	Administrator	Type:	Success Audit

Computer:	ACCTG	Category:	Logon/Logoff

Description:

Logon/Logoff:
Successful Logon

User Name:	Administrator
Domain:	ACCTG

Logon ID:	(0x0, 0xF31)

Logon Type:	2

Logon Process:	User32

Authentication Pkg:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0


Unknown Username or Bad Password
Logon/Logoff Category
Unknown Username or Bad Password

This event record indicates an attempt to log on using an unknown user account or using a valid user account but with an invalid password. An unexpected increase in the number of these audits could represent an attempt by someone to find user accounts and passwords (such as a “dictionary” attack, in which a list of words is used by a program to attempt entry).

Example Detailed View Text:

Date:	9/8/92	Event ID:	529

Time:	10:32:11 AM	Source:	Security

User:	NT AUTHORITY\SYSTEM	Type:	Failure Audit

Computer:	ACCTG	Category:	Logon/Logoff

Description:

Logon/Logoff:
Logon Failure

Reason:	Unknown user name or bad password

User Name:	Administrator
Domain:	ACCTG

Logon Type:	2

Logon Process:	User32

Authentication Pkg:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0


Account Currently Disabled
Logon/Logoff Category
Account Currently Disabled

This event record indicates an attempt to log on using a disabled account.

The event record description contains the following information:

Nature of the failure

Reason for the failure

User account name

Authenticating authority (domain)

Logon type

Logon process name

Authentication package name

Example Detailed View Text:

Date:	9/8/92	Event ID:	531

Time:	10:32:11 AM	Source:	Security

User:	NT AUTHORITY\SYSTEM	Type:	Failure Audit

Computer:	ACCTG	Category:	Logon/Logoff

Description:

Logon/Logoff:
Logon Failure

Reason:	Account currently disabled

User Name:	JimGr
Domain:	ACCTG

Logon Type:	2

Logon Process:	User32

Authentication Pkg:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0


Logon Type Restricted
Logon/Logoff Category
Logon Type Restricted

This event record indicates that an attempt was made to log on, but the local security policy of the computer does not allow the user to log on in the requested fashion (such as interactively).

The event record description contains the following information:

Nature of the failure

Reason for the failure

User account name

Authenticating authority (domain)

Logon type

Logon process name

Authentication package name

Example Detailed View Text

Date:	9/8/92	Event ID:	534

Time:	10:32:11 AM	Source:	Security

User:	NT AUTHORITY\SYSTEM	Type:	Failure Audit

Computer:	ACCTG	Category:	Logon/Logoff

Description:

Logon/Logoff:
Logon Failure

Reason:	The user has not be granted the
requested logon type at this computer

User Name:	Guest
Domain:	ACCTG

Logon Type:	2

Logon Process:	User32

Authentication Pkg:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0


Password Expired
Logon/Logoff Category
Password Expired

This event record indicates an attempt to log on using an account whose password has expired.

The event record description contains the following information:

Nature of the failure

Reason for the failure

User account name

Authenticating authority (domain)

Logon type

Logon process name

Authentication package name

Example Detailed View Text

Date:	9/8/92	Event ID:	535

Time:	10:32:11 AM	Source:	Security

User:	NT AUTHORITY\SYSTEM	Type:	Failure Audit

Computer:	ACCTG	Category:	Logon/Logoff

Description:

Logon/Logoff:
Logon Failure

Reason:	The specified account's password has
expired

User Name:	JimGr
Domain:	ACCTG

Logon Type:	2

Logon Process:	User32

Authentication Pkg:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0


Unsuccessful Logon
Logon/Logoff Category
Unsuccessful Logon

This event record indicates that a logon attempt was made and rejected for some reason other than those covered by explicit audit records in this category.

The event record description contains the following information:

Nature of the failure

Reason for the failure

User account name

Authenticating authority (domain)

Logon type

Logon process name

Authentication package name

Example Detailed View Text

Date:	9/8/92	Event ID:	537

Time:	10:32:11 AM	Source:	Security

User:	NT AUTHORITY\SYSTEM	Type:	Failure Audit

Computer:	ACCTG	Category:	Logon/Logoff

Description:

Logon/Logoff:
Logon Failure
Reason:	An unexpected error occurred during
logon.

User Name:	Administrator
Domain:	ACCTG

Logon Type:	2

Logon Process:	User32

Authentication Pkg:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0


User Logoff
Logon/Logoff Category
User Logoff

This event record indicates that a user has logged off.

The event record description contains the following information:

Nature of the event

User account name of the subject

Authenticating authority

Logon ID of the subject

Logon type being terminated

Example Detailed View Text:

Date:	9/8/92	Event ID:	538

Time:	10:32:11 AM	Source:	Security

User:	Administrator	Type:	Success Audit

Computer:	ACCTG	Category:	Logon/Logoff

Description:

Logon/Logoff:
User Logoff

User Name:	Administrator
Domain:	ACCTG

Logon ID:	(0x0,0x2839)
Logon Type:	2


Object Access Category

Event log records for the Object Access category include the following items:

Accesses

Client Domain

Client Logon ID

Client User Name

Handle ID

Object Name

Object Server

Object Type

Operation ID

Primary Domain

Primary Logon ID

Primary User Name

Process ID

Object Access audit event records sometimes include an operation ID, which is used to associate multiple audit event records with a single operation, such as opening a file. Because of the way the object architecture is designed, the responsibilities for access validation and for handle creation are held by two different components.

In particular, the Object Manager itself is responsible for handle creation. However, object type-specific code is responsible for access validation to objects of that type. For example, the file system is responsible for access validations to file objects. In this case, the file system first causes an audit related to access validation, and the Object Manager later causes another (but related) audit to be generated indicating that a handle to the object has been created.

The Object Access category contains the following events.  For more information, select an event topic.

  Object Open

  Handle Closed


Accesses

The type or types of access to the object that was attempted.


Client Domain

The name of the computer. If the computer is a member of a Windows NT Server domain, this can also be the name of the domain containing the client user’s account.


Client Logon ID

A unique identifier assigned when the client user logged on.


Client User Name

The username of the user on whose behalf the primary user is accessing the object. If this is specified, it is usually the username of a user logged on interactively or remotely.


Handle ID

The handle identifier of the open object.


Object Name

The name (such as a filename) of the object being accessed.


Object Server

The name of the subsystem server process calling the audit-check function.


Object Type

The type of object being accessed.


Operation ID

A unique identifier that associates multiple events resulting from a single operation.


Primary Domain

The name of the computer, or SYSTEM if the user identified by Primary User Name is SYSTEM. If the computer is a member of a Windows NT Server domain, this can also be the name of the domain containing the primary user’s account.


Primary Logon ID

A unique identifier assigned when the primary user logged on


Primary User Name

The username of the user requesting the object access. When impersonation is taking place, this is the username with which the server process is logged on.


Process ID

The identifier of the client process accessing the object. Detailed Tracking events provide information about the process when it is created.


Object Open
Object Access Category
Object Open

This event record indicates either that an object has been successfully opened or that an attempt to open an object was rejected.

The event record description contains the following information:

Object type

Object name

New handle ID string (“-” if open failed)

Operation ID

Subject’s process ID of the primary user

Subject’s primary authentication information

Subject’s client authentication information (if impersonating)

Granted access names (for success), desired access names (for failure)

Names of privileges used for the object open

Example Detailed View Text

This event record type appears in slightly different forms, depending on whether the object is being opened by the kernel or by a protected server. In the examples that follow, successful and unsuccessful audits for kernel object accesses are shown first, followed by successful and unsuccessful audits for protected server objects.

Notice that protected server object audits are unable to display the process ID of the client. Also notice that the source of the protected subsystem's audit is the server name (FramitzServer in this example), not Security as in those audits generated by Windows NT components. This is important because the server name is used in looking up object type-specific access names.

Date:	9/8/92	Event ID:	560

Time:	10:32:11 AM	Source:	Security

User:	Administrator	Type:	Success Audit

Computer:	ACCTG	Category:	Object Access

Description:

Object Open:

Object Server:	Security
Object Type:	File
Object Name:	D:\payroll\hoursworked.dat
New Handle ID:	3128
Operation ID:	{0,11710}
Process ID:	117

Primary User Name:	Administrator
Primary Domain:	ACCTG

Primary Logon ID:	(0x0,0x2839)

Client User Name:	-

Client Domain:	-

Client Logon ID:	-

Accesses :	READ_CONTROL
FILE_READ_DATA

FILE_READ_ATTRIBUTES
Privileges:	Restore From Backup Privilege
Backup Privilege

Date:	9/8/92	Event ID:	560

Time:	10:32:11 AM	Source:	Security

User:	Administrator	Type:	Failure Audit

Computer:	ACCTG	Category:	Object Access

Description:

Object Open:

Object Server:	Security
Object Type:	File
Object Name:	C:\payroll\hoursworked.dat
New Handle ID:	-
Operation ID:	{0,11710}
Process ID:	117

Primary User Name:	Administrator
Primary Domain:	ACCTG

Primary Logon ID:	(0x0,0x2839)

Client User Name:	-

Client Domain:	-

Client Logon ID:	-

Accesses:	READ_CONTROL
FILE_READ_DATA

FILE_READ_ATTRIBUTES
Privileges:	-

Date:	9/8/92	Event ID:	560

Time:	10:32:11 AM	Source:	FramitzServer

User:	Administrator	Type:	Success Audit

Computer:	ACCTG	Category:	Object Access

Description:

Object Open:

Object Server:	FramitzServer
Object Type:	Widget
Object Name:	\Server\Mork\From\Zork\quazzle

New Handle ID:	3128

Operation ID:	{0,11710}
Process ID:	N/A

Primary User Name:	FramitzAcct
Primary Domain:	ACCTG

Primary Logon ID:	(0x00000000, 0x00000311)

Client User Name:	Administrator
Client Domain:	ACCTG

Client Logon ID:	(0x00000000, 0x0000071A)

Accesses:	READ_CONTROL

QUERY_WIDGET_INFO

SET_WIDGET_COLOR

SET_WIDGET_SIZE

START_WIDGET
Privileges:	Turbo-Charge Widget Privilege

Date:	9/8/92	Event ID:	560

Time:	10:32:11 AM	Source:	FramitzServer

User:	Administrator	Type:	Failure Audit

Computer:	ACCTG	Category:	Object Access

Description:

Object Open

Object Server:	FramitzServer
Object Type:	Widget
Object Name:	\Server\Mork\From\Zork\quazzle

New Handle ID:	-

Operation ID:	{0,11710}
Process ID:	N/A

Primary User Name:	FramitzAcct
Primary Domain:	ACCTG

Primary Logon ID:	(0x00000000, 0x00000311)

Client User Name:	Administrator
Client Domain:	ACCTG

Client Logon ID:	(0x00000000, 0x0000071A)

Accesses:	READ_CONTROL

QUERY_WIDGET_INFO

SET_WIDGET_COLOR

SET_WIDGET_SIZE

START_WIDGET
Privileges:	-


Handle Closed
Object Access Category
Handle Closed

This event record indicates that a handle to an object has been closed. This event is only generated for handles that caused an audit to be generated when opened.

The event record description contains the following information:

Subsystem name (name of subsystem exporting the object)

Subject’s process ID

Handle ID

Example Detailed View Text

As with the Object Open audit record, the information available in a Close Handle audit differs, depending on whether the object was opened by the kernel or by a protected server. Protected subsystems do not have a client process ID available. The examples that follow show a kernel object handle close first, then a protected server object handle close.

Date:	9/8/92	Event ID:	562

Time:	10:32:11 AM	Source:	Security

User:	N/A	Type:	Success Audit

Computer:	ACCTG	Category:	Object Access

Description:

Handle Closed:

Object Server:	Security
Handle ID:	3128

Process ID:	117

Date:	9/8/92	Event ID:	562

Time:	10:32:11 AM	Source:	FramitzServer

User:	N/A	Type:	Success Audit

Computer:	ACCTG	Category:	Object Access

Description:

Handle Closed:

Object Server:	FramitzServer
Handle ID:	3128

Process ID:	N/A


Privilege Use Category

Events in this category describe both successful and unsuccessful attempts to use privileges. The Privilege Use category also covers a special case of informing when some special privileges are assigned. These special privileges are only audited when they are assigned, not when they are used.

Event log records for the Privilege Use category include the following items:

Assigned

Client Domain

Client Logon ID

Client User Name

Domain

Logon ID

Object Handle

Object Server

Primary Domain

Primary Logon ID

Primary User Name

Privileges

Process ID

User Name

The Privilege Use category can contain the following events. For more information, select an event topic.

  Special Privilege Assigned

  Privileged Service Called

  Privileged Object Operation


Assigned

The special privilege(s) assigned to a user.


Object Handle

The handle identifier of an object being accessed.


Privileges

Special user privileges invoked to perform an object access.


Special Privilege Assigned
Privilege Use Category
Special Privilege Assigned

This event record indicates that a privilege that is not auditable on an individual use basis has been assigned to a user's security context at logon.

Some privileges are used so frequently that auditing their every use would flood the audit log with useless noise. For example, SeChangeNotifyPrivilege is also used to bypass traverse access checking. This privilege is granted to all users in a normal system configuration and is used multiple times for each file opened. This audit event record is intended to warn an administrator that such a privilege has been assigned.

Currently, the following privileges are treated as special:

SeChangeNotifyPrivilege

SeAuditPrivilege

SeCreateTokenPrivilege

SeAssignPrimaryTokenPrivilege

SeBackupPrivilege

SeRestorePrivilege

SeDebugPrivilege

The event record description contains the following information:

User account name of the user who has logged on

Authenticating authority

Logon ID of the user

Privileges assigned to the user at logon

Example Detailed View Text

Date:	9/8/92	Event ID:	576

Time:	10:32:11 AM	Source:	Security

User:	Administrator	Type:	Success Audit

Computer:	ACCTG	Category:	Privilege Use

Description:

Special privileges assigned to new logon:

User Name:	Administrator

Domain:	ACCTG

Logon ID:	(0x0, 0x2921)

Assigned:	SeChangeNotifyPrivilege
SeAuditPrivilege


Privileged Service Called
Privilege Use Category
Privileged Service Called

This event record indicates that an attempt has been made to use a privilege to perform a privileged system service.

The event record description contains the following information:

Subject's process ID (kernel audits only)

Subject's primary authentication ID

Subject's impersonation authentication ID (if impersonating)

Service name

Protected Server name

Up to 8 privilege names

Example Detailed View Text

This event record can appear in either of two forms, depending on whether the privileged service is provided by the kernel or by a protected server. In the examples that follow, audit event records for privileged use of kernel services are shown first, followed by audits for privileged use of services provided by protected servers.

Protected server audits are unable to display the process ID of the client. Also, the source of the protected subsystem's audit is the server's name (FramitzServer in this case), not Security as in audits generated by Windows NT components.

Date:	9/8/92	Event ID:	577

Time:	10:32:11 AM	Source:	Security

User:	Administrator	Type:	Failure Audit

Computer:	ACCTG	Category:	Privilege Use

Description:

Privileged Service Called:

Service:	SetSystemTime
Server:	Security
Process ID:	117

Primary User Name:	Administrator
Primary Domain:	ACCTG

Primary Logon ID:	(0x0, 0x2921)

Client User Name:	-
Client Domain:	-

Client Logon ID:	-

Privileges:	SeSystemTimePrivilege

Date:	9/8/92	Event ID:	577

Time:	10:32:11 AM	Source:	FramitzServer

User:	Administrator	Type:	Success Audit

Computer:	ACCTG	Category:	Privilege Use

Description:

Privileged Service Called:

Service:	FramitzTweakIt
Server:	FramitzServer
Process ID:	N/A

Primary User Name:	FramitzAcct
Primary Domain:	ACCTG

Primary Logon ID:	(0x0, 0x071A)

Client User Name:	Administrator
Client Domain:	ACCTG

Client Logon ID:	(0x0, 0x2921)

Privileges:	FramitzPriv1

FramitzPriv2


Privileged Object Operation
Privilege Use Category
Privileged Object Operation

This event record indicates the use of privileges to operate on an object. For example, privilege is required to increase the base priority of a process and to change the primary token of a process.

The event record description contains the following information:

Subject's process ID

Subject's primary authentication ID

Subject's impersonation authentication ID (if impersonating)

Object name

Object Type name

Subsystem name (name of subsystem exporting the object)

Up to 8 privilege names

Example Detailed View Text

This event record can appear in either of two forms, depending on whether the privileged service is provided by the kernel or by a protected server. In the examples that follow, audit event records for privileged use of kernel services are shown first, followed by audits for privileged use of services provided by protected servers.

Protected server audits are unable to display the process ID of the client. Also, the source of the protected subsystem's audit is the server's name (FramitzServer in this case), not Security as in those audits generated by Windows NT components.

Date:	9/8/92	Event ID:	578

Time:	10:32:11 AM	Source:	Security

User:	Administrator	Type:	Success Audit

Computer:	ACCTG	Category:	Privilege Use

Description:

Privileged Object Operation:

Object Type:	Process
Object Name:

Object Server:	Security
Process ID:	117

Primary User Name:	Administrator
Primary Domain:	ACCTG

Primary Logon ID:	(0x0, 0x2921)

Client User Name:	-
Client Domain:	-

Client Logon ID:	-

Privileges:	SeIncreaseBasePriorityPrivilege

Date:	9/8/92	Event ID:	578

Time:	10:32:11 AM	Source:	FramitzServer

User:	Administrator	Type:	Failure Audit

Computer:	ACCTG	Category:	Privilege Use

Description:

Privileged Object Operation:

Object Type:	Widget
Object Name:	\Server\Mork\From\Zork\quazzle

Object Server:	FramitzServer
Process ID:	N/A

Primary User Name:	FramitzAcct
Primary Domain:	ACCTG

Primary Logon ID:	(0x0, 0x071A)

Client User Name:	Administrator
Client Domain:	ACCTG

Client Logon ID:	(0x0, 0x2921)

Privileges:	FramitzPriv1

FramitzPriv2


Account Management Category

Events in this category describe high-level changes to the security account database, such as the creation of a user account or a change in group membership. There can also be a finer granularity of auditing performed at the object level under the Object Access category.

Event log records for the Account Management category include the following items:

Caller Domain

Caller Logon ID

Caller User Name

Member

Target Account ID

Target Account Name

Target Domain

The Account Management category can contain the following events.  For additional information, select an event type.

  User Account Created

  User Account Changed

  User Account Deleted

  Global Group Member Added

  Global Group Member Removed

  Local Group Created

  Local Group Member Added

  Local Group Member Removed

  Local Group Changed

  Local Group Deleted


Caller Domain

The name of the computer. If the computer is a member of a Windows NT Server domain, this can also be the name of the domain containing the caller user’s account.


Caller Logon ID

A unique session identifier given when the caller user logged on.


Caller User Name

The username of the user attempting the account management operation.


Member

The account ID (security ID representing the account) of the account being added to or removed from a group.


Target Account ID

The identifier of the account being changed.


Target Account Name

The username or groupname of the account being changed.


Target Domain

The name of the computer containing the account, or Builtin (indicating the target account is a built-in account). If the computer is a Windows NT server, the Target Domain is the name of the domain containing the account.


User Account Created
Account Management Category
User Account Created

This event record indicates that a new user account has been created. There is no Failure Audit form of this audit event record.

The event record description contains the following information:

Subject's authentication ID

New account's name

Domain name

New account's security ID (SID)

Example Detailed View Text

Date:	9/8/92	Event ID:	624

Time:	10:32:11 AM	Source:	Security

User:	Administrator	Type:	Success Audit

Computer:	ACCTG	Category:	Account Management

Description:

User Account Created:

New Account Name:	JimGr
New Domain:	ACCTG
New Account ID:	S-1-5-21-2051343008-1480933967-902061077-1000
Caller User Name:	Administrator
Caller Domain:	ACCTG
Caller Logon ID:	(0x0, 0x2921)
Privileges	-


User Account Changed
Account Management Category
User Account Changed

This event record indicates that a user account has been changed. There is no Failure Audit form of this audit event record.

The event record description contains the following information:

Subject's authentication information

Account name and domain name

Account security ID (SID)

Example Detailed View Text

Date:	9/8/92	Event ID:	642

Time:	10:32:11 AM	Source:	Security

User:	Administrator	Type:	Success Audit

Computer:	ACCTG	Category:	Account Management

Description:

User Account Changed:

Target Account Name:	JimGr
Target Domain:	ACCTG
Target Account ID:	S-1-5-21-2051343008-1480933967-902061077-1000
Caller User Name:	Administrator
Caller Domain:	ACCTG
Caller Logon ID:	(0x0, 0x2921)


User Account Deleted
Account Management Category
User Account Deleted

This event record indicates that a user account has been deleted. There is no Failure Audit form of this audit event record.

The event record description contains the following information:

Subject's authentication information

Account name and domain name

Account security ID (SID)

Example Detailed View Text

Date:	9/8/92	Event ID:	630

Time:	10:32:11 AM	Source:	Security

User:	Administrator	Type:	Success Audit

Computer:	ACCTG	Category:	Account Management

Description:

User Account Deleted:

Target Account Name:	JimGr
Target Domain:	ACCTG
Target Account ID:	S-1-5-21-2051343008-1480933967-902061077-1000

Caller User Name:	Administrator
Caller Domain:	ACCTG
Caller Logon ID:	(0x0, 0x2921)


Global Group Member Added
Account Management Category
Global Group Member Added

This audit record indicates that a new member has been added to a global group. This event occurs when a user account is created and added to the built-in None group used internally by Windows NT. There is no Failure Audit form of this audit event record.

The event record description contains the following information:

Subject’s authentication ID

Security ID (SID) of member added

Account name

Account SID

Example Detailed View Text

Date:	9/8/92	Event ID:	632

Time:	10:32:11 AM	Source:	Security

User:	Administrator	Type:	Success Audit

Computer:	ACCTG	Category:	Account Management

Description:

Global Group Member Added:

Member: S-1-5-21-2051343008-1480933967-902061077-1000
Target Account Name:	None
Target Domain:	ACCTG
Target Account ID:	S-1-5-21-2051343008-1470933967-902061077-513
Caller User Name:	Administrator
Caller Domain:	ACCTG
Caller Logon ID:	(0x0, 0x2921)


Global Group Member Removed
Account Management Category
Global Group Member Removed

This event record indicates that a member has been removed from a global group. This event occurs when a user account is deleted and removed from the built-in None group used internally by Windows NT. There is no Failure Audit form of this audit event record.

The event record description contains the following information:

Subject's authentication ID

Security ID (SID) of member removed

Account name

Account SID

Example Detailed View Text

Date:	9/8/92	Event ID:	633

Time:	10:32:11 AM	Source:	Security

User:	Administrator	Type:	Success Audit

Computer:	ACCTG	Category:	Account Management

Description:

Global Group Member Removed:

Member: S-1-5-21-2051343008-1480933967-902061077-1000

Target Account Name:	None
Target Domain:	ACCTG
Target Account ID:	S-1-5-21-2051343008-1470933967-902061077-513

Caller User Name:	Administrator
Caller Domain:	ACCTG
Caller Logon ID:	(0x0, 0x2921)


Local Group Created
Account Management Category
Local Group Created

This event record indicates that a local group account has been created. There is no Failure Audit form of this audit event record.

The event record description contains the following information:

Target account (group) name

Target account (group) account SID

Subject’s authentication ID

Example Detailed View Text

Date:	9/8/92	Event ID:	635

Time:	10:32:11 AM	Source:	Security

User:	Administrator	Type:	Success Audit

Computer:	ACCTG	Category:	Account Management

Description:

Local Group Created:

Target Account Name:	NewUsers
Target Domain:	ACCTG
Target Account ID:	S-1-5-21-2051343008-1470933967-902061077-513
Caller User Name:	Administrator
Caller Domain:	ACCTG
Caller Logon ID:	(0x0,0x2839)


Local Group Member Added
Account Management Category
Local Group Member Added

This event record indicates that a new member has been added to a local group. There is no Failure Audit form of this audit event record.

The event record description contains the following information:

Security ID (SID) of member added

Target account (group) name

Target account (group) SID

Subject's authentication ID

Example Detailed View Text

Date:	9/8/92	Event ID:	636

Time:	10:32:11 AM	Source:	Security

User:	Administrator	Type:	Success Audit

Computer:	ACCTG	Category:	Account Management

Description:

Local Group Member Added:

Member: S-1-5-21-2051343008-1480933967-902061077-1000
Target Account Name:	NewUsers
Target Domain:	ACCTG
Target Account ID:	S-1-5-21-2051343008-1470933967-902061077-513
Caller User Name:	Administrator
Caller Domain:	ACCTG
Caller Logon ID:	(0x0, 0x2921)

Privileges:	-


Local Group Member Removed
Account Management Category
Local Group Member Removed

This event record indicates that a member has been removed from a local group. There is no Failure Audit form of this audit event record.

The event record description contains the following information:

Security ID (SID) of member removed

Target account (group) name

Target account (group) SID

Subject's authentication ID

Example Detailed View Text

Date:	9/8/92	Event ID:	637

Time:	10:32:11 AM	Source:	Security

User:	Administrator	Type:	Success Audit

Computer:	ACCTG	Category:	Account Management

Description:

Local Group Member Removed:

Member: S-1-5-21-2051343008-1480933967-902061077-1000
Target Account Name:	NewUsers
Target Domain:	ACCTG
Target Account ID:	S-1-5-21-2051343008-1470933967-902061077-513

Caller User Name:	Administrator
Caller Domain:	ACCTG
Caller Logon ID:	(0x0, 0x2921)

Privileges:	-


Local Group Changed
Account Management Category
Local Group Changed

This event record indicates that a change (other than group membership) has been made to a local group. There is no Failure Audit form of this audit event record.

The event record description contains the following information:

Target (group) account name and domain name

Target (group) account security ID (SID)

Subject's authentication information

Example Detailed View Text

Date:	9/8/92	Event ID:	639

Time:	10:32:11 AM	Source:	Security

User:	Administrator	Type:	Success Audit

Computer:	ACCTG	Category:	Account Management

Description:

Local Group Account Changed:

Target Account Name:	NewUsers
Target Domain:	ACCTG
Target Account ID:	S-1-5-21-2051343008-1470933967-902061077-513
Caller User Name:	Administrator
Caller Domain:	ACCTG
Caller Logon ID:	(0x0, 0x2921)


Local Group Deleted
Account Management Category
Local Group Deleted

This event record indicates that a local group has been deleted. There is no Failure Audit form of this audit event record.

The event record description contains the following information:

Target (group) account name and domain name

Target (group) account security ID (SID)

Subject's authentication information

Example Detailed View Text

Date:	9/8/92	Event ID:	638

Time:	10:32:11 AM	Source:	Security

User:	Administrator	Type:	Success Audit

Computer:	ACCTG	Category:	Account Management

Description:

Local Group deleted:

Target Account Name:	NewUsers
Target Domain:	ACCTG
Target Account ID:	S-1-5-21-2051343008-1470933967-902061077-513

Caller User Name:	Administrator
Caller Domain:	ACCTG
Caller Logon ID:	(0x0, 0x2921)


Policy Change Category

Events in this category describe high-level changes in security policy, such as the assignment of privileges or changes in the audit policy. There can also be a finer granularity of auditing performed at the object level under the Object Access category.

Event log records for the Policy Change category include the following items:

Assigned To

Domain

Logon ID

New Policy

Removed From

User Name

User Right

The Policy Change category can contain the following events.  For more information, select an event topic.

  User Right Assigned

  User Right Removed

  Audit Policy Change


Assigned To

The account identifier of the account to which a special privilege is being assigned.


New Policy

A chart showing the auditing that has been enabled.


Removed From

The account identifier of the account from which a special privilege is being removed.


User Name

The username of the user requesting the security policy change.


User Right

A special privilege being assigned to or removed from a user.


User Right Assigned
Policy Change Category
User Right Assigned

This event record indicates that a user right (privilege) has been assigned to or removed from a user account or group. Windows NT generates only successful forms of this audit event record. (Programs must first Create or Open the corresponding “privileged account” LSA object before they can assign or remove a user right from a user or group. This Create or Open establishes the right to make the change; the subsequent action of changing the right is never denied.)

The event record description contains the following information:

Subject's authentication ID

User right name

Security ID (SID) of the account being assigned the right

Example Detailed View Text

Date:	9/8/92	Event ID:	608

Time:	10:32:11 AM	Source:	Security

User:	Administrator	Type:	Success Audit

Computer:	ACCTG	Category:	Policy Change

Description:

User Right Assigned:

User Right:	SeSystemTimePrivilege
Assigned To:	S-1-5-21-2051343008-1480933967-902061077-1000

User Name:	Administrator

Domain:	ACCTG

Logon ID:	(0x0, 0x2921)


User Right Removed
Policy Change Category
User Right Removed

This event record indicates that a user right (privilege or logon capability) has been taken away from the specified user account or group. There is no failed version of this audit.

The event record description contains the following information:

Subject's authentication ID

User right name

Security ID (SID) of the account the right removed

Example Detailed View Text

Date:	9/8/92	Event ID:	609

Time:	10:32:11 AM	Source:	Security

User:	Administrator	Type:	Success Audit

Computer:	ACCTG	Category:	Policy Change

Description:

User Right Removed:

User Right:	SeSystemTimePrivilege
Removed From:	S-1-5-21-2051343008-1480933967-902061077-1000

User Name:	Administrator
Domain:	ACCTG

Logon ID:	(0x0, 0x2921)


Audit Policy Change
Policy Change Category
Audit Policy Change

This event record indicates that audit policy has changed.

The event record description contains the following information:

Subject’s authentication ID

Audit category names and current status (+ / - ).

Example Detailed View Text

Date:	9/8/92	Event ID:	612

Time:	10:32:11 AM	Source:	Security

User:	Administrator	Type:	Success Audit

Computer:	ACCTG	Category:	Policy Change

Description:

Audit Policy Change:

New Policy:
Success	Failure	Category

+	-	System
-	+	Logon\Logoff
+	+	Object Access
-	-	Detailed Tracking
+	-	Privilege Use
+	-	Policy Change
+	+	Account Management

Changed By:
User Name:	Administrator
Domain:	ACCTG
Logon ID:	(0x0, 0x2921)


Detailed Tracking Category

Events in this category provide detailed subject tracking information, such as program activation, some forms of handle duplication and indirect object accesses, and process exit.

Event log records for the Detailed Tracking category include the following items:

Creator Process ID

Domain

Image File Name

Logon ID

New Process ID

Process ID

User Name

When Detailed Tracking is enabled, audit event records are generated every time a new process is created.

Auditing detailed tracking events can help determine whether an apparent security problem is tied to a user or to a program, perhaps one with a virus infecting it. For example, if an audit file shows that three users in the last day tried to create a new user account, it might be worthwhile to monitor process creation for a few days to see if the attempt to create a user account occurs when users run a particular program (other than User Manager, of course).

The Detailed Tracking category can contain the following events.  For more information, select an event topic.

  New Process Has Been Created

  Process Has Exited

  Handle Duplicated

  Indirect Access To Object


Creator Process ID

The process ID of the process spawning a new process.


Image File Name

The name of the file containing the executable code of the process.


New Process ID

A unique identifier assigned when the new process is created.


Process ID

The identifier of the process that has exited.


User Name

The username of the user attempting to create the new process. If Windows NT itself is creating the new process, the user is SYSTEM.


New Process Has Been Created
Detailed Tracking Category
New Process Has Been Created

This event record indicates that a new process has been created.

The event record description contains the following information:

ID of the new process

Image file name

Process ID of the creator

Subject’s and new process’s primary authentication ID

Example Detailed View Text

Date:	9/8/92	Event ID:	592

Time:	10:32:11 AM	Source:	Security

User:	Administrator	Type:	Success Audit

Computer:	ACCTG	Category:	Detailed Tracking

Description:

A new process has been created.

New Process ID:	4852196208

Image File Name:	CMD.EXE

Creator Process ID:	4285090672

User Name:	Administrator
Domain:	ACCTG

Logon ID:	(0x0, 0x2921)


Process Has Exited
Detailed Tracking Category
Process Has Exited

This event record indicates that a particular process has exited.

The event record description contains the following information:

Subject’s process ID

Subject’s logon ID

Example Detailed View Text

Date:	9/8/92	Event ID:	593

Time:	10:32:11 AM	Source:	Security

User:	Administrator	Type:	Success Audit

Computer:	ACCTG	Category:	Detailed Tracking

Description:

A process has exited.

Process ID:	117

User Name:	Administrator
Domain:	ACCTG

Logon ID:	(0x0, 0x2921)


Handle Duplicated
Detailed Tracking Category
Handle Duplicated

This event record indicates that a handle has been duplicated for the same or less access than previously granted. This audit event is only generated if the handle being duplicated caused an audit event record to be displayed when created.

If the duplication is for more access than the source handle has been granted, then the duplication is treated as an object open and an Object Open audit record is generated instead of a Duplicate Handle audit record.

If the source handle is closed, a separate Handle Closed audit record is generated.

Windows NT does not support duplication of protected server objects. Handle Duplication audit records always refer to kernel objects.

The event record description contains the following information:

Source Subject's process ID

Source Handle ID

Target Subject's process ID

New ID

Example Detailed View Text

Date:	9/8/92	Event ID:	594

Time:	10:32:11 AM	Source:	Security

User:	JimGr	Type:	Success Audit

Computer:	ACCTG	Category:	Detailed Tracking

Description:

Handle Duplicated:

Source Handle ID:	3128

Source Process ID:	117

New Handle ID:	4725

Target Process ID:	152


Indirect Access to Object
Detailed Tracking Category
Indirect Access to Object

One operation performed by Windows NT that causes an access check on an object when creating another object is connecting to an LPC (local procedure call) port. This audit record is used to describe that operation.

The event record description contains the following information:

Subject's process ID

Subject's primary authentication ID

Subject's impersonation authentication ID (if impersonating)

Referenced Object name

Referenced Object Type name

Subsystem name (name of subsystem exporting the object)

New handle ID

Granted access mask

Granted access names

Example Detailed View Text

Date:	9/8/92	Event ID:	595

Time:	10:32:11 AM	Source:	Security

User:	Administrator	Type:	Success Audit

Computer:	ACCTG	Category:	Detailed Tracking

Description:

Indirect Access To Object:

Object Type:	Port
Object Name:	\BaseNamedObjects\Test_Port

Via Handle ID:	3128

Object Server:	Security
Process ID:	117

Primary User Name:	Administrator
Primary Domain:	ACCTG

Primary Logon ID:	(0x0, 0x2921)

Client User Name:	-
Client Domain:	-

Client Logon ID:	-

Accesses Granted:	PORT_CONNECT