Select the product you need help with
Windows 2000 Security Event Descriptions (Part 2 of 2)Article ID: 301677 - View products that this article applies to. This article was previously published under Q301677 NoticeThis article applies to Windows 2000. Support for Windows 2000 ends on July 13, 2010. The Windows 2000 End-of-Support Solution Center
(http://support.microsoft.com/?scid=http%3a%2f%2fsupport.microsoft.com%2fwin2000)
is a starting point for planning your migration strategy from Windows 2000. For more information see the Microsoft Support Lifecycle
Policy
(http://support.microsoft.com/lifecycle/)
.SUMMARY
This article contains descriptions of various security-related and auditing-related events, and information about how to interpret these events. These events will all appear in the Security event log and will be logged with a source of "Security." The following article in the Microsoft Knowledge Base is Part 1 of 2:
299475
(http://support.microsoft.com/kb/299475/EN-US/
)
Windows 2000 Security Event Descriptions (Part 1 of 2)
MORE INFORMATION
Event ID: 608 (0x0260)
Type: Success Audit
Description: User Right Assigned
User Right: %1 Assigned To: %2
Assigned By User Name: %3 Domain: %4
Logon ID: %5
Event ID: 609 (0x0261)
Type: Success Audit
Description: User Right Removed
User Right: %1 Removed From: %2
Removed By: User Name: %3 Domain: %4
Logon ID: %5
Event ID: 610 (0x0262)
Type: Success Audit
Description: New Trusted Domain
Domain Name: %1 Domain ID: %2
Established By:
User Name: %3 Domain: %4
Logon ID: %5
Event ID: 611 (0x0263)
Type: Success Audit
Description: Removing Trusted Domain
Domain Name: %1 Domain ID: %2
Removed By: User Name: %3 Domain: %4
Logon ID: %5
Event ID: 612 (0x0264)
Type: Success Audit
Description: Audit Policy Change
New Policy:
Success Failure
%1 %2 System
%3 %4 Logon/Logoff
%5 %6 Object Access
%7 %8 Privilege Use
%9 %10 Detailed Tracking
%11 %12 Policy Change
%13 %14 Account Management
Changed By:
User Name: %15 Domain Name: %16
Logon ID: %17
Event ID: 613 (0x0265)
Type: Success Audit
Description: IPSec policy agent started
Ipsec Policy Agent: %1 Policy Source: %2
Event Data: %3
Event ID: 614 (0x0266)
Type: Success Audit
Description: IPSec policy agent disabled
Ipsec Policy Agent: %1 Event Data: %2
Event ID: 615 (0x0267)
Type: Success Audit
Description: IPSEC PolicyAgent Service: %1
Event Data: %1
Event ID: 616 (0x0268)
Type: Failure Audit
Description: IPSec policy agent encountered a potentially serious failure.
Event Data: %1
Event ID: 617 (0x0269)
Type: Success Audit
Description: Kerberos Policy Changed
Changed By: User Name: %1 Domain Name: %2
Logon ID: %3
Changes made: %4
'-' means no changes, otherwise each change is shown as:
Parameter Name: (new value) (old value)
Event ID: 618 (0x026a)
Type: Success Audit
Description: Encrypted Data Recovery Policy Changed
Changed By: User Name: %1 Domain Name: %2
Logon ID: %3
Changes made: %4
'-' means no changes, otherwise each change is shown as:
Parameter Name: new value (old value)
Event ID: 619 (0x026b)
Type: Success Audit
Description: Quality of Service Policy Changed
Changed By: User Name: %1 Domain Name: %2
Logon ID: %3
Changes made: %4
'-' means no changes, otherwise each change is shown as:
Parameter Name: new value (old value)
Event ID: 620 (0x026C)
Description: Trusted Domain Information Modified:
Domain Name: %1 Domain ID: %2
Modified By: User Name: %3 Domain: %4
Logon ID: %5
Event ID: 624 (0x0270)
Type: Success Audit
Description: User Account Created
New Account Name: %1 New Domain: %2
New Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges %7
Event ID: 625 (0x0271)
Description: User Account Type Change
Type: Success Audit
Target Account Name: %1 Target Domain: %2
Target Account ID: %3
New Type: %4 Caller User Name: %5
Caller Domain: %6 Caller Logon ID: %7
Event ID: 626 (0x0272)
Description: User Account Enabled
Type: Success Audit
Target Account Name: %1 Target Domain: %2
Target Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6
Note Windows 2000 does not log event ID 626 explicitly. Results are logged as a part of event ID 642 in the description of the message.
Event ID: 627 (0x0273)
Type: Success Audit
Description: Change Password Attempt
Target Account Name: %1 Target Domain: %2
Target Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 628 (0x0274)
Type: Success Audit
Description: User Account password set
Target Account Name: %1 Target Domain: %2
Target Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6
Event ID: 630 (0x0276)
Type: Success Audit
Description: User Account Deleted:
Target Account Name: %1 Target Domain: %2
Target Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 631 (0x0277)
Type: Success Audit
Description: Security Enabled Global Group Created
New Account Name: %1 New Domain: %2
New Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 632 (0x0278)
Type: Success Audit
Description: Security Enabled Global Group Member Added
Member Name: %1 Member ID: %2
Target Account Name: %3 Target Domain: %4
Target Account ID: %5
Caller User Name: %6 Caller Domain: %7
Caller Logon ID: %8 Privileges: %9
Event ID: 633 (0x0279)
Type: Success Audit
Description: Security Enabled Global Group Member Removed
Member Name: %1 Member ID: %2
Target Account Name: %3 Target Domain: %4
Target Account ID: %5
Caller User Name: %6 Caller Domain: %7
Caller Logon ID: %8 Privileges: %9
Event ID: 634 (0x027A)
Type: Success Audit
Description: Security Enabled Global Group Deleted
Target Account Name: %1 Target Domain: %2
Target Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 635 (0x027B)
Type: Success Audit
Description: Security Enabled Local Group Created
New Account Name: %1 New Domain: %2
New Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 636 (0x027C)
Type: Success Audit
Description: Security Enabled Local Group Member Added
Member Name: %1 Member ID: %2
Target Account Name: %3 Target Domain: %4
Target Account ID: %5
Caller User Name: %6 Caller Domain: %7
Caller Logon ID: %8 Privileges: %9
Event ID: 637 (0x027D)
Type: Success Audit
Description: Security Enabled Local Group Member Removed
Member Name: %1 Member ID: %2
Target Account Name: %3 Target Domain: %4
Target Account ID: %5
Caller User Name: %6 Caller Domain: %7
Caller Logon ID: %8 Privileges: %9
Event ID: 638 (0x027E)
Type: Success Audit
Description: Security Enabled Local Group Deleted
Target Account Name: %1 Target Domain: %2
Target Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 639 (0x027F)
Type: Success Audit
Description: Security Enabled Local Group Changed
Target Account Name: %1 Target Domain: %2
Target Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 640 (0x0280)
Type: Success Audit
Description: General Account Database Change
Type of change: %1 Object Type: %2
Object Name: %3 Object ID: %4
Caller User Name: %5 Caller Domain: %6
Caller Logon ID: %7
Event ID: 641 (0x0281)
Type: Success Audit
Description: Security Enabled Global Group Changed
Target Account Name: %1 Target Domain: %2
Target Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 642 (0x0282)
Type: Success Audit
Description: User Account Changed
Target Account Name: %1 Target Domain: %2
Target Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 643 (0x0283)
Type: Success Audit
Description: Domain Policy Changed: %1 modified
Domain: %2 Domain ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 644 (0x0284)
Type: Success Audit
Description: User Account Locked Out
Target Account Name: %1 Target Account ID: %3
Caller Machine Name: %2
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6
Event ID: 645 (0x0285)
Type: Success Audit
Description: Computer Account Created
New Account Name: %1 New Domain: %2
New Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges %7
Event ID: 646 (0x0286)
Type: Success Audit
Description: Computer Account Changed
Target Account Name: %1 Target Domain: %2
Target Account ID: %3
Caller User Name: %5 Caller Domain: %6
Caller Logon ID: %7 Privileges: %8
Event ID: 647 (0x0287)
Type: Success Audit
Description: Computer Account Deleted
Target Account Name: %1 Target Domain: %2
Target Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 648 (0x0288)
Type: Success Audit
Description: Security Disabled Local Group Created
Target Account Name: %1 Target Domain: %2
Target Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 649 (0x0289)
Type: Success Audit
Description: Security Disabled Local Group Changed
Target Account Name: %1 Target Domain: %2
Target Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 650 (0x028A)
Type: Success Audit
Description: Security Disabled Local Group Member Added
Member Name: %1 Member ID: %2
Target Account Name: %3 Target Domain: %4
Target Account ID: %5
Caller User Name: %6 Caller Domain: %7
Caller Logon ID: %8 Privileges: %9
Event ID: 651 (0x028B)
Type: Success Audit
Description: Security Disabled Local Group Member Removed
Member Name: %1 Member ID: %2
Target Account Name: %3 Target Domain: %4
Target Account ID: %5
Caller User Name: %6 Caller Domain: %7
Caller Logon ID: %8 Privileges: %9
Event ID: 652 (0x028C)
Type: Success Audit
Description: Security Disabled Local Group Deleted
Target Account Name: %1 Target Domain: %2
Target Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 653 (0x028D)
Type: Success Audit
Description: Security Disabled Global Group Created
New Account Name: %1 New Domain: %2
New Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 654 (0x028E)
Type: Success Audit
Description: Security Disabled Global Group Changed
Target Account Name: %1 Target Domain: %2
Target Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 655 (0x028F)
Type: Success Audit
Description: Security Disabled Global Group Member Added
Member Name: %1 Member ID: %2
Target Account Name: %3 Target Domain: %4
Target Account ID: %5
Caller User Name: %6 Caller Domain: %7
Caller Logon ID: %8 Privileges: %9
Event ID: 656 (0x0290)
Type: Success Audit
Description: Security Disabled Global Group Member Removed
Member Name: %1 Member ID: %2
Target Account Name: %3 Target Domain: %4
Target Account ID: %5
Caller User Name: %6 Caller Domain: %7
Caller Logon ID: %8 Privileges: %9
Event ID: 657 (0x0291)
Type: Success Audit
Description: Security Disabled Global Group Deleted
Target Account Name: %1 Target Domain: %2
Target Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 658 (0x0292)
Type: Success Audit
Description: Security Enabled Universal Group Created
New Account Name: %1 New Domain: %2
New Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 659 (0x0293)
Type: Success Audit
Description: Security Enabled Universal Group Changed
Target Account Name: %1 Target Domain: %2
Target Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 660 (0x0294)
Type: Success Audit
Description: Security Enabled Universal Group Member Added
Member Name: %1 Member ID: %2
Target Account Name: %3 Target Domain: %4
Target Account ID: %5
Caller User Name: %6 Caller Domain: %7
Caller Logon ID: %8 Privileges: %9
Event ID: 661 (0x0295)
Type: Success Audit
Description: Security Enabled Universal Group Member Removed
Member Name: %1 Member ID: %2
Target Account Name: %3 Target Domain: %4
Target Account ID: %5
Caller User Name: %6 Caller Domain: %7
Caller Logon ID: %8 Privileges: %9
Event ID: 662 (0x0296)
Type: Success Audit
Description: Security Enabled Universal Group Deleted
Target Account Name: %1 Target Domain: %2
Target Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 663 (0x0297)
Type: Success Audit
Description: Security Disabled Universal Group Created
New Account Name: %1 New Domain: %2
New Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 664 (0x0298)
Type: Success Audit
Description: Security Disabled Universal Group Changed
Target Account Name: %1 Target Domain: %2
Target Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 665 (0x0299)
Type: Success Audit
Description: Security Disabled Universal Group Member Added
Member Name: %1 Member ID: %2
Target Account Name: %3 Target Domain: %4
Target Account ID: %5
Caller User Name: %6 Caller Domain: %7
Caller Logon ID: %8 Privileges: %9
Event ID: 666 (0x029A)
Type: Success Audit
Description: Security Disabled Universal Group Member Removed
Member Name: %1 Member ID: %2
Target Account Name: %3 Target Domain: %4
Target Account ID: %5
Caller User Name: %6 Caller Domain: %7
Caller Logon ID: %8 Privileges: %9
Event ID: 667 (0x029B)
Type: Success Audit
Description: Security Disabled Universal Group Deleted
Target Account Name: %1 Target Domain: %2
Target Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 668 (0x029C)
Type: Success Audit
Description: Group Type Changed
Target Account Name: %1 Target Domain: %2
Target Account ID: %3
Caller User Name: %5 Caller Domain: %6
Caller Logon ID: %7 Privileges: %8
Event ID: 669 (0x029D)
Type: Success Audit
Description: Add SID History
Source Account Name: %1 Source Account ID: %2
Target Account Name: %3 Target Domain: %4
Target Account ID: %5
Caller User Name: %6 Caller Domain: %7
Caller Logon ID: %8 Privileges: %9
Event ID: 670 (0x029E)
Type: Success Audit
Description: Add SID History
Source Account Name: %1 Target Account Name: %2
Target Domain: %3 Target Account ID: %4
Caller User Name: %5 Caller Domain: %6
Caller Logon ID: %7 Privileges: %8
Event ID: 672 (0x02a0)
Type: Success Audit
Description: Authentication Ticket Granted
User Name: %1 Supplied Realm Name: %2
User ID: %3 Service Name: %4
Service ID: %5 Ticket Options: %6
Ticket Encryption Type: %7 Pre-Authentication Type: %8
Client Address: %9
Event ID: 673 (0x02a1)
Type: Success Audit
Description: Service Ticket Granted
User Name: %1 User Domain: %2
Service Name: %3 Service ID: %4
Ticket Options: %5 Ticket Encryption Type: %6
Client Address: %7
Event ID: 674 (0x02a2)
Type: Success Audit
Description: Ticket Granted Renewed
User Name: %1 User Domain: %2
Service Name: %3 Service ID: %4
Ticket Options: %5 Ticket Encryption Type: %6
Client Address: %7
Event ID: 675 (0x02a3)
Type: Failure Audit
Description: Pre-authentication failed
User Name: %1 User ID: %2
Service Name: %3 Pre-Authentication Type: %4
Failure Code: %5 Client Address: %6
Event ID: 676 (0x02a4)
Type: Failure Audit
Description: Authentication Ticket Request Failed
User Name: %1 Supplied Realm Name: %2
Service Name: %3 Ticket Options: %4
Failure Code: %5 Client Address: %6
Event ID: 677 (0x02a5)
Type: Failure Audit
Description: Service Ticket Request Failed:
Description: Authentication Ticket Request Failed
User Name: %1 Supplied Realm Name: %2
Service Name: %3 Ticket Options: %4
Failure Code: %5 Client Address: %6
Event ID: 678 (0x02a6)
Type: Success Audit
Description: Account Mapped for Logon by: %1
Client Name: %2 Mapped Name:%3
Event ID: 679 (0x02a7)
Type: Failure Audit
Description: The name: %2 could not be mapped for logon by: %1
Event ID: 680 (0x02a8)
Type: Success Audit
Description: Account Used for Logon by: %1
Account Name: %2 Workstation: %3
Event ID: 681 (0x02a9)
Type: Failure Audit
Description: The logon to account: %2 by: %1 from workstation: %3 failed. The error code was: %4
Event ID: 682 (0x02aa)
Type: Success Audit
Description: Session reconnected to winstation:
User Name: %1 Domain: %2
Logon ID: %3 Session Name: %4
Client Name: %5 Client Address: %6
Event ID: 683 (0x02ab)
Type: Success Audit
Description: Session disconnected from winstation:
User Name: %1 Domain: %2
Logon ID: %3 Session Name: %4
Client Name: %5 Client Address: %6
PropertiesArticle ID: 301677 - Last Review: January 31, 2007 - Revision: 3.4 APPLIES TO
| Article Translations |
Back to the top
