Event ID

Event message

分類

類別

4670

Permissions on an object were changed.

Audit Other Policy Change Events

 Policy Change

4704

A user right was assigned.

Audit Authorization Policy Change

 Policy Change

4705

A user right was removed.

Audit Authorization Policy Change

 Policy Change

4706

A new trust was created to a domain.

Audit Authorization Policy Change

 Policy Change

4707

A trust to a domain was removed.

Audit Authorization Policy Change

 Policy Change

4709

IPsec Services was started.

Audit Filtering Platform Policy Change

 Policy Change

4710

IPsec Services was disabled.

Audit Filtering Platform Policy Change

 Policy Change

4711

May contain any one of the following:PAStore Engine applied locally cached copy of Active Directory storage IPsec policy on the computer. 

Audit Filtering Platform Policy Change

 Policy Change

4712

IPsec Services encountered a potentially serious failure.

Audit Filtering Platform Policy Change

 Policy Change

4713

Kerberos policy was changed.

Audit Authentication Policy Change

 Policy Change

4714

Encrypted data recovery policy was changed.

Audit Authorization Policy Change

 Policy Change

4715

The audit policy (SACL) on an object was changed.

Audit Audit Policy Change

 Policy Change

4716

Trusted domain information was modified.

Audit Authentication Policy Change

 Policy Change

4717

System security access was granted to an account.

Audit Authentication Policy Change

 Policy Change

4718

System security access was removed from an account.

Audit Authentication Policy Change

 Policy Change

4719

System audit policy was changed.

Audit Audit Policy Change

 Policy Change

4720

A user account was created.

Audit User

Account Management

4722

A user account was enabled.

Audit User

Account Management

4723

An attempt was made to change an account‘s password.

Audit User

Account Management

4724

An attempt was made to reset an account‘s password.

Audit User

Account Management

4725

A user account was disabled.

Audit User

Account Management

4726

A user account was deleted.

Audit User

Account Management

4727

A security-enabled global group was created.

Audit Security Group

Account Management

4728

A member was added to a security-enabled global group.

Audit Security Group

Account Management

4729

A member was removed from a security-enabled global group.

Audit Security Group

Account Management

4730

A security-enabled global group was deleted.

Audit Security Group

Account Management

4731

A security-enabled local group was created.

Audit Security Group

Account Management

4732

A member was added to a security-enabled local group.

Audit Security Group

Account Management

4733

A member was removed from a security-enabled local group.

Audit Security Group

Account Management

4734

A security-enabled local group was deleted.

Audit Security Group

Account Management

4735

A security-enabled local group was changed.

Audit Security Group

Account Management

4737

A security-enabled global group was changed.

Audit Security Group

Account Management

4738

A user account was changed.

Audit User

Account Management

4739

Domain Policy was changed.

Audit Authentication Policy Change

 Policy Change

4740

A user account was locked out.

Audit User

Account Management

4741

A computer account was created.

Audit Computer

Account Management

4742

A computer account was changed.

Audit Computer

Account Management

4743

A computer account was deleted.

Audit Computer

Account Management

4744

A security-disabled local group was created.

Audit Distribution Group

Account Management

4745

A security-disabled local group was changed.

Audit Distribution Group

Account Management

4746

A member was added to a security-disabled local group.

Audit Distribution Group

Account Management

4747

A member was removed from a security-disabled local group.

Audit Distribution Group

Account Management

4748

A security-disabled local group was deleted.

Audit Distribution Group

Account Management

4749

A security-disabled global group was created.

Audit Distribution Group

Account Management

4750

A security-disabled global group was changed.

Audit Distribution Group

Account Management

4751

A member was added to a security-disabled global group.

Audit Distribution Group

Account Management

4752

A member was removed from a security-disabled global group.

Audit Distribution Group

Account Management

4753

A security-disabled global group was deleted.

Audit Distribution Group

Account Management

4754

A security-enabled universal group was created.

Audit Security Group

Account Management

4755

A security-enabled universal group was changed.

Audit Security Group

Account Management

4756

A member was added to a security-enabled universal group.

Audit Security Group

Account Management

4757

A member was removed from a security-enabled universal group.

Audit Security Group

Account Management

4758

A security-enabled universal group was deleted.

Audit Security Group

Account Management

4759

A security-disabled universal group was created.

Audit Distribution Group

Account Management

4760

A security-disabled universal group was changed.

Audit Distribution Group

Account Management

4761

A member was added to a security-disabled universal group.

Audit Distribution Group

Account Management

4762

A member was removed from a security-disabled universal group.

Audit Distribution Group

Account Management

4764

A group‘s type was changed.

Audit Security Group

Account Management

4765

SID History was added to an account.

Audit User

Account Management

4766

An attempt to add SID History to an account failed.

Audit User

Account Management

4767

A user account was unlocked.

Audit User

Account Management

4780

The ACL was set on accounts which are members of administrators groups.

Audit User

Account Management

4781

The name of an account was changed:

Audit User

Account Management

4782

The password hash for an account was accessed.

Audit Other Account

Account Management

4783

A basic application group was created.

Audit Application Group

Account Management

4784

A basic application group was changed.

Audit Application Group

Account Management

4785

A member was added to a basic application group.

Audit Application Group

Account Management

4786

A member was removed from a basic application group.

Audit Application Group

Account Management

4787

A non-member was added to a basic application group.

Audit Application Group

Account Management

4788

A non-member was removed from a basic application group.

Audit Application Group

Account Management

4789

A basic application group was deleted.

Audit Application Group

Account Management

4790

An LDAP query group was created.

Audit Application Group

Account Management

4793

The Password Policy Checking API was called.

Audit Other Account

Account Management

4794

An attempt was made to set the Directory Services Restore Mode.

Audit User

Account Management

4817

Auditing settings on an object were changed.

Audit Audit Policy Change

 Policy Change

4864

A namespace collision was detected.

Audit Authentication Policy Change

 Policy Change

4865

A trusted forest information entry was added.

Audit Authentication Policy Change

 Policy Change

4866

A trusted forest information entry was removed.

Audit Authentication Policy Change

 Policy Change

4867

A trusted forest information entry was modified.

Audit Authentication Policy Change

 Policy Change

4902

The Per-user audit policy table was created.

Audit Audit Policy Change

 Policy Change

4904

An attempt was made to register a security event source.

Audit Audit Policy Change

 Policy Change

4905

An attempt was made to unregister a security event source.

Audit Audit Policy Change

 Policy Change

4906

The CrashOnAuditFail value has changed.

Audit Audit Policy Change

 Policy Change

4907

Auditing settings on object were changed.

Audit Audit Policy Change

 Policy Change

4908

Special Groups Logon table modified.

Audit Audit Policy Change

 Policy Change

4909

The local policy settings for the TBS were changed.

Audit Other Policy Change Events

 Policy Change

4910

The group policy settings for the TBS were changed.

Audit Other Policy Change Events

 Policy Change

4912

Per User Audit Policy was changed.

Audit Audit Policy Change

 Policy Change

4944

The following policy was active when the Windows Firewall started.

Audit MPSSVC Rule-Level Policy Change

 Policy Change

4945

A rule was listed when the Windows Firewall started.

Audit MPSSVC Rule-Level Policy Change

 Policy Change

4946

A change has been made to Windows Firewall exception list. A rule was added.

Audit MPSSVC Rule-Level Policy Change

 Policy Change

4947

A change has been made to Windows Firewall exception list. A rule was modified.

Audit MPSSVC Rule-Level Policy Change

 Policy Change

4948

A change has been made to Windows Firewall exception list. A rule was deleted.

Audit MPSSVC Rule-Level Policy Change

 Policy Change

4949

Windows Firewall settings were restored to the default values.

Audit MPSSVC Rule-Level Policy Change

 Policy Change

4950

A Windows Firewall setting has changed.

Audit MPSSVC Rule-Level Policy Change

 Policy Change

4951

A rule has been ignored because its major version number was not recognized by Windows Firewall.

Audit MPSSVC Rule-Level Policy Change

 Policy Change

4952

Parts of a rule have been ignored because its minor version number was not recognized by Windows Firewall. The other parts of the rule will be enforced.

Audit MPSSVC Rule-Level Policy Change

 Policy Change

4953

A rule has been ignored by Windows Firewall because it could not parse the rule.

Audit MPSSVC Rule-Level Policy Change

 Policy Change

4954

Windows Firewall Group Policy settings have changed. The new settings have been applied.

Audit MPSSVC Rule-Level Policy Change

 Policy Change

4956

Windows Firewall has changed the active profile.

Audit MPSSVC Rule-Level Policy Change

 Policy Change

4957

Windows Firewall did not apply the following rule:

Audit MPSSVC Rule-Level Policy Change

 Policy Change

4958

Windows Firewall did not apply the following rule because the rule referred to items not configured on this computer:

Audit MPSSVC Rule-Level Policy Change

 Policy Change

5040

A change has been made to IPsec settings. An Authentication Set was added.

Audit Filtering Platform Policy Change

 Policy Change

5041

A change has been made to IPsec settings. An Authentication Set was modified.

Audit Filtering Platform Policy Change

 Policy Change

5042

A change has been made to IPsec settings. An Authentication Set was deleted.

Audit Filtering Platform Policy Change

 Policy Change

5043

A change has been made to IPsec settings. A Connection Security Rule was added.

Audit Filtering Platform Policy Change

 Policy Change

5044

A change has been made to IPsec settings. A Connection Security Rule was modified.

Audit Filtering Platform Policy Change

 Policy Change

5045

A change has been made to IPsec settings. A Connection Security Rule was deleted.

Audit Filtering Platform Policy Change

 Policy Change

5046

A change has been made to IPsec settings. A Crypto Set was added.

Audit Filtering Platform Policy Change

 Policy Change

5047

A change has been made to IPsec settings. A Crypto Set was modified.

Audit Filtering Platform Policy Change

 Policy Change

5048

A change has been made to IPsec settings. A Crypto Set was deleted.

Audit Filtering Platform Policy Change

 Policy Change

5063

A cryptographic provider operation was attempted.

Audit Other Policy Change Events

 Policy Change

5064

A cryptographic context operation was attempted.

Audit Other Policy Change Events

 Policy Change

5065

A cryptographic context modification was attempted.

Audit Other Policy Change Events

 Policy Change

5066

A cryptographic function operation was attempted.

Audit Other Policy Change Events

 Policy Change

5067

A cryptographic function modification was attempted.

Audit Other Policy Change Events

 Policy Change

5068

A cryptographic function provider operation was attempted.

Audit Other Policy Change Events

 Policy Change

5069

A cryptographic function property operation was attempted.

Audit Other Policy Change Events

 Policy Change

5070

A cryptographic function property modification was attempted.

Audit Other Policy Change Events

 Policy Change

5376

Credential Manager credentials were backed up.

Audit User

Account Management

5377

Credential Manager credentials were restored from a backup.

Audit User

Account Management

5440

The following callout was present when the Windows Filtering Platform Base Filtering Engine started.

Audit Filtering Platform Policy Change

 Policy Change

5441

The following filter was present when the Windows Filtering Platform Base Filtering Engine started.

Audit Filtering Platform Policy Change

 Policy Change

5442

The following provider was present when the Windows Filtering Platform Base Filtering Engine started.

Audit Filtering Platform Policy Change

 Policy Change

5443

The following provider context was present when the Windows Filtering Platform Base Filtering Engine started.

Audit Filtering Platform Policy Change

 Policy Change

5444

The following sub-layer was present when the Windows Filtering Platform Base Filtering Engine started.

Audit Filtering Platform Policy Change

 Policy Change

5446

A Windows Filtering Platform callout has been changed.

Audit Filtering Platform Policy Change

 Policy Change

5447

A Windows Filtering Platform filter has been changed.

Audit Other Policy Change Events

 Policy Change

5448

A Windows Filtering Platform provider has been changed.

Audit Filtering Platform Policy Change

 Policy Change

5449

A Windows Filtering Platform provider context has been changed.

Audit Filtering Platform Policy Change

 Policy Change

5450

A Windows Filtering Platform sub-layer has been changed.

Audit Filtering Platform Policy Change

 Policy Change

5456

PAStore Engine applied Active Directory storage IPsec policy on the computer.

Audit Filtering Platform Policy Change

 Policy Change

5457

PAStore Engine failed to apply Active Directory storage IPsec policy on the computer.

Audit Filtering Platform Policy Change

 Policy Change

5458

PAStore Engine applied locally cached copy of Active Directory storage IPsec policy on the computer.

Audit Filtering Platform Policy Change

 Policy Change

5459

PAStore Engine failed to apply locally cached copy of Active Directory storage IPsec policy on the computer.

Audit Filtering Platform Policy Change

 Policy Change

5460

PAStore Engine applied local registry storage IPsec policy on the computer.

Audit Filtering Platform Policy Change

 Policy Change

5461

PAStore Engine failed to apply local registry storage IPsec policy on the computer.

Audit Filtering Platform Policy Change

 Policy Change

5462

PAStore Engine failed to apply some rules of the active IPsec policy on the computer. Use the IP Security Monitor snap-in to diagnose the problem.

Audit Filtering Platform Policy Change

 Policy Change

5463

PAStore Engine polled for changes to the active IPsec policy and detected no changes.

Audit Filtering Platform Policy Change

 Policy Change

5464

PAStore Engine polled for changes to the active IPsec policy, detected changes, and applied them to IPsec Services.

Audit Filtering Platform Policy Change

 Policy Change

5465

PAStore Engine received a control for forced reloading of IPsec policy and processed the control successfully.

Audit Filtering Platform Policy Change

 Policy Change

5466

PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory cannot be reached, and will use the cached copy of the Active Directory IPsec policy instead. Any changes made to the Active Directory IPsec policy since the last poll could not be applied.

Audit Filtering Platform Policy Change

 Policy Change

5467

PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, and found no changes to the policy. The cached copy of the Active Directory IPsec policy is no longer being used.

Audit Filtering Platform Policy Change

 Policy Change

5468

PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, found changes to the policy, and applied those changes. The cached copy of the Active Directory IPsec policy is no longer being used.

Audit Filtering Platform Policy Change

 Policy Change

5471

PAStore Engine loaded local storage IPsec policy on the computer.

Audit Filtering Platform Policy Change

 Policy Change

5472

PAStore Engine failed to load local storage IPsec policy on the computer.

Audit Filtering Platform Policy Change

 Policy Change

5473

PAStore Engine loaded directory storage IPsec policy on the computer.

Audit Filtering Platform Policy Change

 Policy Change

5474

PAStore Engine failed to load directory storage IPsec policy on the computer.

Audit Filtering Platform Policy Change

 Policy Change

5477

PAStore Engine failed to add quick mode filter.

Audit Filtering Platform Policy Change

 Policy Change

6144

Security policy in the group policy objects has been applied successfully.

Audit Other Policy Change Events

 Policy Change

6145

One or more errors occurred while processing security policy in the group policy objects.

Audit Other Policy Change Events

 Policy Change