Windows Event ID reference

The client could not reach \\domain\SYSVOL. Causes: wrong DNS, stalled SYSVOL replication, NTFS permissions.

Most of the policy applied but one part (drive maps, scripts) failed. gpresult shows which.

Someone cleared the security log. In a healthy environment this is almost never legitimate.

Sites & Services configuration cannot yield a replication path: a site with no Site Link, or an unassigned subnet.

A DC received an update for an object others already deleted — a sign it was offline past the tombstone lifetime.

A DC tried to replicate an object already deleted elsewhere. AD stops replication with that partner. Usual cause: the DC was offline longer than the tombstone lifetime (180 days).

The DC crossed the tombstone lifetime, so replication is blocked entirely.

A client binds to LDAP without signing/encryption — the password crosses the network exposed. Find every such client before enforcing LDAP signing.

The workstation cannot authenticate to the DC. The familiar wording: "The trust relationship between this workstation and the primary domain failed".

A successful sign-in. Logon Type tells you how: 2 = local, 3 = network (share), 10 = RDP, 5 = service.

A logon attempt failed. Status/Sub Status explains why: 0xC000006A wrong password, 0xC0000064 no such user, 0xC0000234 account locked.

Logged together with 4624 and lists the groups the user belonged to at logon. It shows at a glance when someone with Domain Admins rights signs in.

A session ended. Mostly used to measure session length together with 4624 — not every 4624 gets a matching 4634.

A user ran something as another account. A classic manual lateral-movement signal.

A detail-rich event. If Properties include the DS-Replication-Get-Changes-All GUID and the account is not a DC, that is DCSync.

The logon received sensitive privileges (SeDebug, SeBackup, SeTakeOwnership). Almost always accompanies an admin logon.

Scheduled tasks are a popular persistence trick: they survive reboots and look harmless.

Someone changed what gets logged. Attackers disable auditing right before the real action — hence critical.

A new user was created. After a breach this is a classic persistence step.

A password change made with knowledge of the old password — unlike 4724, an admin-driven reset.

An admin or helpdesk reset someone's password. Against a privileged account, investigate.

A user was deleted. Deletion is usually a mistake — disable instead. Recovery needs the AD Recycle Bin enabled beforehand.

Someone gained rights through a global group. For Domain Admins / Enterprise Admins this is a top-priority alert.

The inverse of 4728. Matters in two cases: an employee leaving, or an attacker cleaning up after abusing a privilege.

Adding to the local Administrators group on a server or PC — a quiet way to gain control without touching Domain Admins.

Pairs with 4732. Domain Local groups usually hold the actual permissions on resources (shares, printers).

Account attributes changed: UAC flags, SPN, password-never-expires, encryption. A new SPN on a normal user is a red flag (Kerberoasting).

A domain-wide policy change: password length, lockout policy, password age. It affects everyone.

The account exceeded the bad-password threshold. The event always lands on the PDC Emulator; Caller Computer Name points at the source.

Universal groups include Enterprise Admins and Schema Admins — the strongest privileges in the forest.

Pairs with 4756. In an attack context: covering tracks after using forest-level privileges.

Someone manually unlocked an account. Worth knowing who — especially for privileged accounts.

Start of Kerberos authentication. Watch Ticket Encryption Type: 0x17 (RC4) on a modern account can mean downgrade or AS-REP Roasting.

A user requested a ticket for a service. Many RC4 (0x17) requests from one user to many services signal Kerberoasting.

An existing ticket was extended without re-authentication. Perfectly normal in long sessions.

TGT request rejected. 0x18 wrong password, 0x12 account disabled/locked/expired, 0x25 clock skew over 5 minutes.

The DC validated a password over NTLM. Microsoft is retiring NTLM — every 4776 today is a question: who still uses it and why.

Someone requested a certificate from the CA server (AD CS). Normal by itself — but this is where ESC1 starts: a request carrying another user's name (SAN).

The certificate was issued. If it names an admin but went to someone else, the attacker can log in as that admin (ESC1) — even after a password reset.

A mechanism that alerts when a member of a group you defined (e.g. Domain Admins) logs on anywhere.

Records an attribute change on an AD object. Editing a GPO changes gPCFileSysPath/versionNumber — that is how you see who changed policy.

The computer account password does not match. Typical after restoring an old snapshot or with a duplicate machine name.

A computer talks to the domain but has no AD account — deleted, or never properly joined.

A new service was registered. PsExec, Cobalt Strike and many lateral-movement tools leave traces here.