You are currently offline, waiting for your internet to reconnect

Security Event Descriptions

This article was previously published under Q174074
SUMMARY
This article contains descriptions of various security-related and auditing-related events, and tips for interpreting them.

These events will all appear in the Security event log and will be loggedwith a source of "Security."
MORE INFORMATION
   Event ID: 512       Type: Success AuditDescription: Windows NT is starting up.   Event ID: 513       Type: Success AuditDescription: Windows NT is shutting down. All logon sessions will be             terminated by this shutdown.   Event ID: 514       Type: Success AuditDescription: An authentication package has been loaded by the Local             Security Authority. This authentication package will be             used to authenticate logon attempts.             Authentication Package Name: %1   Event ID: 515       Type: Success AuditDescription: A trusted logon process has registered with the Local             Security Authority. This logon process will be trusted to             submit logon requests.             Logon Process Name: %1   Event ID: 516       Type: Success AuditDescription: Internal resources allocated for the queuing of audit             messages have been exhausted, leading to the loss of some             audits.             Number of audit messages discarded: %1   Event ID: 517       Type: Success AuditDescription: The audit log was cleared             Primary User Name: %1      Primary Domain: %2             Primary Logon ID: %3       Client User Name: %4             Client Domain: %5          Client Logon ID: %6   Event ID: 518       Type: Success AuditDescription: A notification package has been loaded by the Security             Account Manager. This package will be notified of any             account or password changes.             Notification Package Name: %1   Event ID: 528       Type: Success AuditDescription: Successful Logon:             User Name: %1             Domain: %2             Logon ID: %3              Logon Type: %4             Logon Process: %5         Authentication Package: %6             Workstation Name: %7   Event ID: 529       Type: Failure AuditDescription: Logon Failure:             Reason: Unknown user name or bad password             User Name: %1              Domain: %2             Logon Type: %3             Logon Process: %4             Authentication Package: %5 Workstation Name: %6   Event ID: 530       Type: Failure AuditDescription: Logon Failure:             Reason: Account logon time restriction violation             User Name: %1              Domain: %2             Logon Type: %3             Logon Process: %4             Authentication Package: %5 Workstation Name: %6   Event ID: 531       Type: Failure AuditDescription: Logon Failure:             Reason: Account currently disabled             User Name: %1              Domain: %2             Logon Type: %3             Logon Process: %4             Authentication Package: %5 Workstation Name: %6   Event ID: 532       Type: Failure AuditDescription: Logon Failure:             Reason: The specified user account has expired             User Name: %1              Domain: %2             Logon Type: %3             Logon Process: %4             Authentication Package: %5 Workstation Name: %6   Event ID: 533       Type: Failure AuditDescription: Logon Failure:             Reason: User not allowed to logon at this computer             User Name: %1              Domain: %2             Logon Type: %3             Logon Process: %4             Authentication Package: %5 Workstation Name: %6   Event ID: 534       Type: Failure AuditDescription: Logon Failure:             Reason: The user has not been granted the requested logon             type at this machine             User Name: %1              Domain: %2             Logon Type: %3             Logon Process: %4             Authentication Package: %5 Workstation Name: %6   Event ID: 535       Type: Failure AuditDescription: Logon Failure:             Reason: The specified account's password has expired             User Name: %1              Domain: %2             Logon Type: %3             Logon Process: %4             Authentication Package: %5 Workstation Name: %6   Event ID: 536       Type: Failure AuditDescription: Logon Failure:             Reason: The NetLogon component is not active             User Name: %1              Domain: %2             Logon Type: %3             Logon Process: %4             Authentication Package: %5 Workstation Name: %6   Event ID: 537       Type: Failure AuditDescription: Logon Failure:             Reason: An unexpected error occurred during logon             User Name: %1              Domain: %2             Logon Type: %3             Logon Process: %4             Authentication Package: %5 Workstation Name: %6   Event ID: 538       Type: Success AuditDescription: User Logoff:             User Name: %1             Domain: %2             Logon ID: %3              Logon Type: %4   Event ID: 539       Type: Failure AuditDescription: Logon Failure:             Reason: Account locked out             User Name: %1              Domain: %2             Logon Type: %3             Logon Process: %4             Authentication Package: %5 Workstation Name: %6   Event ID: 560       Type: Success AuditDescription: Object Open:             Object Server: %1          Object Type: %2             Object Name: %3            New Handle ID: %4             Operation ID: {%5,%6}             Process ID: %7             Primary User Name: %8             Primary Domain: %9         Primary Logon ID: %10             Client User Name: %11      Client Domain: %12             Client Logon ID: %13       Accesses %14             Privileges %15   Event ID: 561       Type: Success AuditDescription: Handle Allocated:             Handle ID: %1              Operation ID: {%2,%3}             Process ID: %4   Event ID: 562       Type: Success AuditDescription: Handle Closed:             Object Server: %1          Handle ID: %2             Process ID: %3   Event ID: 563       Type: Success AuditDescription: Object Open for Delete:             Object Server: %1          Object   Type: %2             Object Name: %3            New Handle ID: %4             Operation ID: {%5,%6}             Process ID: %7             Primary User Name: %8             Primary Domain: %9         Primary Logon ID: %10             Client User Name: %11      Client Domain: %12             Client Logon ID: %13       Accesses %14             Privileges %15   Event ID: 564       Type: Success AuditDescription: Object Deleted:             Object Server: %1          Handle ID: %2             Process ID: %3   Event ID: 576       Type: Success AuditDescription: Special privileges assigned to new logon:             User Name: %1             Domain: %2             Logon ID: %3              Assigned: %4   Event ID: 577       Type: Success AuditDescription: Privileged Service Called:             Server: %1              Service: %2             Primary User Name: %3      Primary Domain: %4             Primary Logon ID: %5       Client User Name: %6             Client Domain: %7          Client Logon ID: %8             Privileges: %9   Event ID: 578       Type: Failure AuditDescription: Privileged object operation:             Object Server: %1          Object Handle: %2             Process ID: %3             Primary User Name: %4             Primary Domain: %5         Primary Logon ID: %6             Client User Name: %7       Client Domain: %8             Client Logon ID: %9        Privileges: %10   Event ID: 592       Type: Success AuditDescription: A new process has been created:             New Process ID: %1         Image File Name: %2             Creator Process ID: %3     User Name: %4             Domain: %5                 Logon ID: %6   Event ID: 593       Type: Success AuditDescription: A process has exited:             Process ID: %1             User Name: %2             Domain: %3              Logon ID: %4   Event ID: 594       Type: Success AuditDescription: A handle to an object has been duplicated:             Source Handle ID: %1       Source Process ID: %2             Target Handle ID: %3       Target Process ID: %4   Event ID: 595       Type: Success AuditDescription: Indirect access to an object has been obtained:             Object   Type: %1          Object Name: %2             Process ID: %3             Primary User Name: %4             Primary Domain: %5         Primary Logon ID: %6             Client User Name: %7       Client Domain: %8             Client Logon ID: %9        Accesses: %10   Event ID: 608       Type: Success AuditDescription: User Right Assigned:             User Right: %1             Assigned To: %2             Assigned By:             User Name: %3              Domain: %4             Logon ID: %5   Event ID: 609       Type: Success AuditDescription: User Right Removed:             User Right: %1             Removed From: %2             Removed By:             User Name: %3              Domain: %4             Logon ID: %5   Event ID: 610       Type: Success AuditDescription: New Trusted Domain:             Domain Name: %1            Domain ID: %2             Established By:             User Name: %3              Domain: %4             Logon ID: %5   Event ID: 611       Type: Success AuditDescription: Removing Trusted Domain:             Domain Name: %1            Domain ID: %2             Removed By:             User Name: %3              Domain: %4             Logon ID: %5   Event ID: 612       Type: Success AuditDescription: Audit Policy Change:             New Policy:             Success   Failure               %1         %2    System               %3         %4    Logon/Logoff               %5         %6    Object Access               %7         %8    Privilege Use               %9        %10    Detailed Tracking              %11        %12    Policy Change              %13        %14    Account Management             Changed By:             User Name: %15             Domain Name: %16             Logon ID: %17   Event ID: 624       Type: Success AuditDescription: User Account Created:             New Account Name: %1       New Domain: %2             New Account ID: %3         Caller User Name: %4             Caller Domain: %5          Caller Logon ID: %6             Privileges %7   Event ID: 625       Type: Success AuditDescription: User Account Type Change:             Target Account Name: %1    Target Domain: %2             Target Account ID: %3      New Type: %4             Caller User Name: %5       Caller Domain: %6             Caller Logon ID: %7   Event ID: 626       Type: Success AuditDescription: User Account Enabled:             Target Account Name: %1    Target Domain: %2             Target Account ID: %3      Caller User Name: %4             Caller Domain: %5          Caller Logon ID: %6   Event ID: 627       Type: Success AuditDescription: Change Password Attempt:             Target Account Name: %1    Target Domain: %2             Target Account ID: %3      Caller User Name: %4             Caller Domain: %5          Caller Logon ID: %6             Privileges: %7   Event ID: 628       Type: Success AuditDescription: User Account password set:             Target Account Name: %1    Target Domain: %2             Target Account ID: %3      Caller User Name: %4             Caller Domain: %5          Caller Logon ID: %6   Event ID: 629       Type: Success AuditDescription: User Account Disabled:             Target Account Name: %1    Target Domain: %2             Target Account ID: %3      Caller User Name: %4             Caller Domain: %5          Caller Logon ID: %6   Event ID: 630       Type: Success AuditDescription: User Account Deleted:             Target Account Name: %1    Target Domain: %2             Target Account ID: %3      Caller User Name: %4             Caller Domain: %5          Caller Logon ID: %6             Privileges: %7   Event ID: 631       Type: Success AuditDescription: Global Group Created:             New Account Name: %1       New Domain: %2             New Account ID: %3         Caller User Name: %4             Caller Domain: %5          Caller Logon ID: %6             Privileges: %7   Event ID: 632       Type: Success AuditDescription: Global Group Member Added:             Member: %1                 Target Account Name: %2             Target Domain: %3          Target Account ID: %4             Caller User Name: %5       Caller Domain: %6             Caller Logon ID: %7        Privileges: %8   Event ID: 633       Type: Success AuditDescription: Global Group Member Removed:             Member: %1                 Target Account Name: %2             Target Domain: %3          Target Account ID: %4             Caller User Name: %5       Caller Domain: %6             Caller Logon ID: %7        Privileges: %8   Event ID: 634       Type: Success AuditDescription: Global Group Deleted:             Target Account Name: %1    Target Domain: %2             Target Account ID: %3      Caller User Name: %4             Caller Domain: %5          Caller Logon ID: %6             Privileges: %7   Event ID: 635       Type: Success AuditDescription: Local Group Created:             New Account Name: %1       New Domain: %2             New Account ID: %3         Caller User Name: %4             Caller Domain: %5          Caller Logon ID: %6             Privileges: %7   Event ID: 636       Type: Success AuditDescription: Local Group Member Added:             Member: %1                 Target Account Name: %2             Target Domain: %3          Target Account ID: %4             Caller User Name: %5       Caller Domain: %6             Caller Logon ID: %7        Privileges: %8   Event ID: 637       Type: Success AuditDescription: Local Group Member Removed:             Member: %1                 Target Account Name: %2             Target Domain: %3          Target Account ID: %4             Caller User Name: %5       Caller Domain: %6             Caller Logon ID: %7        Privileges: %8   Event ID: 638       Type: Success AuditDescription: Local Group Deleted:             Target Account Name: %1    Target Domain: %2             Target Account ID: %3      Caller User Name: %4             Caller Domain: %5          Caller Logon ID: %6             Privileges: %7   Event ID: 639       Type: Success AuditDescription: Local Group Changed:             Target Account Name: %1    Target Domain: %2             Target Account ID: %3      Caller User Name: %4             Caller Domain: %5          Caller Logon ID: %6             Privileges: %7   Event ID: 640       Type: Success AuditDescription: General Account Database Change:             Type of change: %1         Object Type: %2             Object Name: %3            Object ID: %4             Caller User Name: %5       Caller Domain: %6             Caller Logon ID: %7   Event ID: 641       Type: Success AuditDescription: Global Group Changed:             Target Account Name: %1    Target Domain: %2             Target Account ID: %3      Caller User Name: %4             Caller Domain: %5          Caller Logon ID: %6             Privileges: %7   Event ID: 642       Type: Success AuditDescription: User Account Changed:             Target Account Name: %1    Target Domain: %2             Target Account ID: %3      Caller User Name: %4             Caller Domain: %5          Caller Logon ID: %6             Privileges: %7   Event ID: 643       Type: Success AuditDescription: Domain Policy Changed:             Domain: %1                 Domain ID: %2             Caller User Name: %3       Caller Domain: %4             Caller Logon ID: %5        Privileges: %6   Event ID: 644 Event Type: Success AuditDescription: User Account Locked OutTarget Account Name:  %1   Target Account ID: %2Caller Machine Name:  %3    Caller User Name:  %4Caller Domain:      %5        Caller Logon ID:  %6				
hack sec evt
Properties

Article ID: 174074 - Last Review: 11/01/2006 04:52:42 - Revision: 2.1

  • Microsoft Windows NT Workstation 3.5
  • Microsoft Windows NT Workstation 3.51
  • Microsoft Windows NT Workstation 4.0 Developer Edition
  • Microsoft Windows NT Server 3.5
  • Microsoft Windows NT Server 3.51
  • Microsoft Windows NT Server 4.0 Standard Edition
  • kbinfo KB174074
Feedback