EventCode,LogName,"Windows_OS_Support","more_info",signature,"signature_severity",state
1,Application,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,EMET,LOW,NA
2,Application,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,EMET,LOW,NA
865,Application,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"SRP Block",LOW,NA
866,Application,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"SRP Block",LOW,NA
867,Application,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"SRP Block",LOW,NA
868,Application,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"SRP Block",LOW,NA
882,Application,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"SRP Block",LOW,NA
1000,Application,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"App Error",LOW,Error
1001,Application,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)","Detection of product '%1', feature '%2' failed during request for component '%3'","Windows Error Reporting",LOW,Failed
1002,Application,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)","Unexpected or missing value (name: '%1', value: '%2') in key '%3'. Error message that there was an unexpected or missing value.","App Hang",LOW,Failed
1022,Application,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)","Product: %1 - Update '%2' installed successfully.","Update Installation Completed",LOW,"Success Update"
1033,Application,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)","Product: %1. Version: %2. Language: %3. Installation completed with status: %4. Manufacturer: %5.","Installation Completed",LOW,"Success Install"
8006,"Microsoft-Windows-AppLocker/MSI and Script","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"AppLocker Warning",MEDIUM,NA
8007,"Microsoft-Windows-AppLocker/MSI and Script","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"AppLocker Warning",MEDIUM,NA
8003,"Microsoft-Windows-AppLocker_EXE and DLL","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"AppLocker Block",LOW,NA
8004,"Microsoft-Windows-AppLocker_MSI and Script","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"AppLocker Block",LOW,NA
800,"Microsoft-Windows-Application-Experience/Program-Inventory","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Summary of Software Activities",LOW,NA
903,"Microsoft-Windows-Application-Experience/Program-Inventory","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"New Application Installation",LOW,NA
904,"Microsoft-Windows-Application-Experience/Program-Inventory","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"New Application Installation",LOW,NA
905,"Microsoft-Windows-Application-Experience/Program-Inventory","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Updated Application",LOW,NA
906,"Microsoft-Windows-Application-Experience/Program-Inventory","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Updated Application",LOW,NA
907,"Microsoft-Windows-Application-Experience/Program-Inventory","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Removed Application",LOW,NA
908,"Microsoft-Windows-Application-Experience/Program-Inventory","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Removed Application",LOW,NA
3001,"Microsoft-Windows-CodeIntegrity/Operational","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Code Integrity Check",LOW,NA
3002,"Microsoft-Windows-CodeIntegrity/Operational","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Code Integrity Check",LOW,NA
3003,"Microsoft-Windows-CodeIntegrity/Operational","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Code Integrity Check",LOW,NA
3004,"Microsoft-Windows-CodeIntegrity/Operational","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Code Integrity Check",LOW,NA
3010,"Microsoft-Windows-CodeIntegrity/Operational","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Code Integrity Check",LOW,NA
3023,"Microsoft-Windows-CodeIntegrity/Operational","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Code Integrity Check",LOW,NA
400,"Microsoft-Windows-Kernel-PnP/Device Configuration","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"New Mass Storage Installation",LOW,NA
410,"Microsoft-Windows-Kernel-PnP/Device Configuration","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"New Mass Storage Installation",LOW,NA
10000,"Microsoft-Windows-NetworkProfile/Operational","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Network Connection and Disconnection Status (Wired and Wireless)",LOW,NA
10001,"Microsoft-Windows-NetworkProfile/Operational","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Network Connection and Disconnection Status (Wired and Wireless)",LOW,NA
307,"Microsoft-Windows-PrintService/Operational","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Printing Document",LOW,NA
43,"Microsoft-Windows-USB-USBHUB3-Analytic","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"New Device Information",LOW,NA
8002,"Microsoft-Windows-WLAN- AutoConfig/Operational","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Wireless Connection Failed",LOW,NA
11004,"Microsoft-Windows-WLAN- AutoConfig/Operational","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Wireless Security Started, Stopped, Successful, or Failed",LOW,Success
11005,"Microsoft-Windows-WLAN- AutoConfig/Operational","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Wireless Security Started, Stopped, Successful, or Failed",LOW,Success
11006,"Microsoft-Windows-WLAN- AutoConfig/Operational","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Wireless Security Started, Stopped, Successful, or Failed",LOW,Success
11010,"Microsoft-Windows-WLAN- AutoConfig/Operational","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Wireless Security Started, Stopped, Successful, or Failed",LOW,Success
8000,"Microsoft-Windows-WLAN-AutoConfig/Operational","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Starting a Wireless connection",LOW,NA
8001,"Microsoft-Windows-WLAN-AutoConfig/Operational","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Successfully connected to Wireless connection",LOW,Success
8003,"Microsoft-Windows-WLAN-AutoConfig/Operational","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Disconnect from Wireless connection",LOW,NA
8011,"Microsoft-Windows-WLAN-AutoConfig/Operational","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Starting a Wireless connection",LOW,NA
11000,"Microsoft-Windows-WLAN-AutoConfig/Operational","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Wireless Association Status",LOW,NA
11001,"Microsoft-Windows-WLAN-AutoConfig/Operational","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Wireless Association Status",LOW,NA
11002,"Microsoft-Windows-WLAN-AutoConfig/Operational","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Wireless Association Status",LOW,NA
12011,"Microsoft-Windows-WLAN-AutoConfig/Operational","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Wireless Authentication Started and Failed",LOW,NA
12012,"Microsoft-Windows-WLAN-AutoConfig/Operational","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Wireless Authentication Started and Failed",LOW,NA
12013,"Microsoft-Windows-WLAN-AutoConfig/Operational","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Wireless Authentication Started and Failed",LOW,NA
1005,"Microsoft-Windows-Windows Defender/Operational","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Scan Failed",LOW,NA
1006,"Microsoft-Windows-Windows Defender/Operational","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Detected Malware",MEDIUM,NA
1008,"Microsoft-Windows-Windows Defender/Operational","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Action on Malware Failed",MEDIUM,NA
1010,"Microsoft-Windows-Windows Defender/Operational","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Failed to remove item from quarantine",LOW,NA
2001,"Microsoft-Windows-Windows Defender/Operational","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Failed to update signatures",LOW,NA
2003,"Microsoft-Windows-Windows Defender/Operational","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Failed to update engine",LOW,NA
2004,"Microsoft-Windows-Windows Defender/Operational","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Reverting to last known good set of signatures",LOW,NA
3002,"Microsoft-Windows-Windows Defender/Operational","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Real-Time Protection failed",LOW,Failed
5008,"Microsoft-Windows-Windows Defender/Operational","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Unexpected Error",LOW,Error
2004,"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Firewall Rule Add",LOW,NA
2005,"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Firewall Rule Change",LOW,NA
2006,"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Firewall Rules Deleted",LOW,NA
2009,"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Firewall Failed to load Group Policy",LOW,NA
2033,"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Firewall Rules Deleted",LOW,NA
20,"Microsoft-Windows-WindowsUpdateClient/Operational","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Windows Update Failed",LOW,NA
24,"Microsoft-Windows-WindowsUpdateClient/Operational","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Windows Update Failed",LOW,NA
25,"Microsoft-Windows-WindowsUpdateClient/Operational","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Windows Update Failed",LOW,NA
31,"Microsoft-Windows-WindowsUpdateClient/Operational","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Windows Update Failed",LOW,NA
34,"Microsoft-Windows-WindowsUpdateClient/Operational","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Windows Update Failed",LOW,NA
35,"Microsoft-Windows-WindowsUpdateClient/Operational","Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Windows Update Failed",LOW,NA
512,Security,"Windows (2000 XP) and Windows Server (2003)",,"Windows NT is starting up",LOW,NA
513,Security,"Windows (2000 XP) and Windows Server (2003)",,"Windows is shutting down",LOW,NA
514,Security,"Windows (2000 XP) and Windows Server (2003)",,"An authentication package has been loaded by the Local Security Authority",LOW,NA
515,Security,"Windows (2000 XP) and Windows Server (2003)",,"A trusted logon process has registered with the Local Security Authority",LOW,NA
516,Security,"Windows (2000 XP) and Windows Server (2003)",,"Internal resources allocated for the queuing of audit messages have been exhausted  leading to the loss of some audits",LOW,NA
517,Security,"Windows (2000 XP) and Windows Server (2003)",,"The audit log was cleared",LOW,NA
518,Security,"Windows (2000 XP) and Windows Server (2003)",,"A notification package has been loaded by the Security Account Manager",LOW,NA
519,Security,"Windows (2000 XP) and Windows Server (2003)",,"A process is using an invalid local procedure call (LPC) port",LOW,NA
520,Security,"Windows (2000 XP) and Windows Server (2003)",,"The system time was changed",LOW,NA
521,Security,"Windows (2000 XP) and Windows Server (2003)",,"Unable to log events to security log",LOW,NA
528,Security,"Windows (2000 XP) and Windows Server (2003)",,"Successful Logon",LOW,Success
529,Security,"Windows (2000 XP) and Windows Server (2003)",,"Logon Failure – Unknown user name or bad password",LOW,NA
530,Security,"Windows (2000 XP) and Windows Server (2003)",,"Logon Failure – Account logon time restriction violation",LOW,NA
531,Security,"Windows (2000 XP) and Windows Server (2003)",,"Logon Failure – Account currently disabled",LOW,NA
532,Security,"Windows (2000 XP) and Windows Server (2003)",,"Logon Failure – The specified user account has expired",LOW,NA
533,Security,"Windows (2000 XP) and Windows Server (2003)",,"Logon Failure – User not allowed to logon at this computer",LOW,NA
534,Security,"Windows (2000 XP) and Windows Server (2003)",,"Logon Failure – The user has not been granted the requested logon type at this machine",LOW,NA
535,Security,"Windows (2000 XP) and Windows Server (2003)",,"Logon Failure – The specified account’s password has expired",LOW,NA
536,Security,"Windows (2000 XP) and Windows Server (2003)",,"Logon Failure – The NetLogon component is not active",LOW,NA
537,Security,"Windows (2000 XP) and Windows Server (2003)",,"Logon failure – The logon attempt failed for other reasons.",LOW,Failed
538,Security,"Windows (2000 XP) and Windows Server (2003)",,"User Logoff",LOW,NA
539,Security,"Windows (2000 XP) and Windows Server (2003)",,"Logon Failure – Account locked out",LOW,NA
540,Security,"Windows (2000 XP) and Windows Server (2003)",,"Successful Network Logon",LOW,Success
551,Security,"Windows (2000 XP) and Windows Server (2003)",,"User initiated logoff",LOW,NA
552,Security,"Windows (2000 XP) and Windows Server (2003)",,"Logon attempt using explicit credentials",LOW,NA
560,Security,"Windows (2000 XP) and Windows Server (2003)",,"Object Open",LOW,NA
561,Security,"Windows (2000 XP) and Windows Server (2003)",,"Handle Allocated",LOW,NA
562,Security,"Windows (2000 XP) and Windows Server (2003)",,"Handle Closed",LOW,NA
563,Security,"Windows (2000 XP) and Windows Server (2003)",,"Object Open for Delete",LOW,NA
564,Security,"Windows (2000 XP) and Windows Server (2003)",,"Object Deleted",LOW,NA
565,Security,"Windows (2000 XP) and Windows Server (2003)",,"Object Open (Active Directory)",LOW,NA
566,Security,"Windows (2000 XP) and Windows Server (2003)",,"Object Operation (Active Directory)",LOW,NA
567,Security,"Windows (2000 XP) and Windows Server (2003)",,"Object Access Attempt",LOW,NA
576,Security,"Windows (2000 XP) and Windows Server (2003)",,"Special privileges assigned to new logon",LOW,NA
577,Security,"Windows (2000 XP) and Windows Server (2003)",,"Privileged Service Called",LOW,NA
578,Security,"Windows (2000 XP) and Windows Server (2003)",,"Privileged object operation",LOW,NA
592,Security,"Windows (2000 XP) and Windows Server (2003)",,"A new process has been created",LOW,NA
593,Security,"Windows (2000 XP) and Windows Server (2003)",,"A process has exited",LOW,NA
594,Security,"Windows (2000 XP) and Windows Server (2003)",,"A handle to an object has been duplicated",LOW,NA
595,Security,"Windows (2000 XP) and Windows Server (2003)",,"Indirect access to an object has been obtained",LOW,NA
596,Security,"Windows (2000 XP) and Windows Server (2003)",,"Backup of data protection master key",LOW,NA
600,Security,"Windows (2000 XP) and Windows Server (2003)",,"A process was assigned a primary token",LOW,NA
601,Security,"Windows (2000 XP) and Windows Server (2003)",,"Attempt to install service",LOW,NA
602,Security,"Windows (2000 XP) and Windows Server (2003)",,"Scheduled Task created",LOW,NA
608,Security,"Windows (2000 XP) and Windows Server (2003)",,"User Right Assigned",LOW,NA
609,Security,"Windows (2000 XP) and Windows Server (2003)",,"User Right Removed",LOW,NA
610,Security,"Windows (2000 XP) and Windows Server (2003)",,"New Trusted Domain",LOW,NA
611,Security,"Windows (2000 XP) and Windows Server (2003)",,"Removing Trusted Domain",LOW,NA
612,Security,"Windows (2000 XP) and Windows Server (2003)",,"Audit Policy Change",LOW,NA
613,Security,"Windows (2000 XP) and Windows Server (2003)",,"IPSec policy agent started",LOW,NA
614,Security,"Windows (2000 XP) and Windows Server (2003)",,"IPSec policy agent disabled",LOW,NA
615,Security,"Windows (2000 XP) and Windows Server (2003)",,"IPSEC PolicyAgent Service",LOW,NA
616,Security,"Windows (2000 XP) and Windows Server (2003)",,"IPSec policy agent encountered a potentially serious failure.",LOW,Failed
617,Security,"Windows (2000 XP) and Windows Server (2003)",,"Kerberos Policy Changed",LOW,NA
618,Security,"Windows (2000 XP) and Windows Server (2003)",,"Encrypted Data Recovery Policy Changed",LOW,NA
619,Security,"Windows (2000 XP) and Windows Server (2003)",,"Quality of Service Policy Changed",LOW,NA
620,Security,"Windows (2000 XP) and Windows Server (2003)",,"Trusted Domain Information Modified",LOW,NA
621,Security,"Windows (2000 XP) and Windows Server (2003)",,"System Security Access Granted",LOW,NA
622,Security,"Windows (2000 XP) and Windows Server (2003)",,"System Security Access Removed",LOW,NA
623,Security,"Windows (2000 XP) and Windows Server (2003)",,"Per User Audit Policy was refreshed",LOW,NA
624,Security,"Windows (2000 XP) and Windows Server (2003)",,"User Account Created",LOW,NA
625,Security,"Windows (2000 XP) and Windows Server (2003)",,"User Account Type Changed",LOW,NA
626,Security,"Windows (2000 XP) and Windows Server (2003)",,"User Account Enabled",LOW,NA
627,Security,"Windows (2000 XP) and Windows Server (2003)",,"Change Password Attempt",LOW,NA
628,Security,"Windows (2000 XP) and Windows Server (2003)",,"User Account password set",LOW,NA
629,Security,"Windows (2000 XP) and Windows Server (2003)",,"User Account Disabled",LOW,NA
630,Security,"Windows (2000 XP) and Windows Server (2003)",,"User Account Deleted",LOW,NA
631,Security,"Windows (2000 XP) and Windows Server (2003)",,"Security Enabled Global Group Created",LOW,NA
632,Security,"Windows (2000 XP) and Windows Server (2003)",,"Security Enabled Global Group Member Added",LOW,NA
633,Security,"Windows (2000 XP) and Windows Server (2003)",,"Security Enabled Global Group Member Removed",LOW,NA
634,Security,"Windows (2000 XP) and Windows Server (2003)",,"Security Enabled Global Group Deleted",LOW,NA
635,Security,"Windows (2000 XP) and Windows Server (2003)",,"Security Enabled Local Group Created",LOW,NA
636,Security,"Windows (2000 XP) and Windows Server (2003)",,"Security Enabled Local Group Member Added",LOW,NA
637,Security,"Windows (2000 XP) and Windows Server (2003)",,"Security Enabled Local Group Member Removed",LOW,NA
638,Security,"Windows (2000 XP) and Windows Server (2003)",,"Security Enabled Local Group Deleted",LOW,NA
639,Security,"Windows (2000 XP) and Windows Server (2003)",,"Security Enabled Local Group Changed",LOW,NA
640,Security,"Windows (2000 XP) and Windows Server (2003)",,"General Account Database Change",LOW,NA
641,Security,"Windows (2000 XP) and Windows Server (2003)",,"Security Enabled Global Group Changed",LOW,NA
642,Security,"Windows (2000 XP) and Windows Server (2003)",,"User Account Changed",LOW,NA
643,Security,"Windows (2000 XP) and Windows Server (2003)",,"Domain Policy Changed",LOW,NA
644,Security,"Windows (2000 XP) and Windows Server (2003)",,"User Account Locked Out",LOW,NA
645,Security,"Windows (2000 XP) and Windows Server (2003)",,"Computer Account Created",LOW,NA
646,Security,"Windows (2000 XP) and Windows Server (2003)",,"Computer Account Changed",LOW,NA
647,Security,"Windows (2000 XP) and Windows Server (2003)",,"Computer Account Deleted",LOW,NA
648,Security,"Windows (2000 XP) and Windows Server (2003)",,"Security Disabled Local Group Created",LOW,NA
649,Security,"Windows (2000 XP) and Windows Server (2003)",,"Security Disabled Local Group Changed",LOW,NA
650,Security,"Windows (2000 XP) and Windows Server (2003)",,"Security Disabled Local Group Member Added",LOW,NA
651,Security,"Windows (2000 XP) and Windows Server (2003)",,"Security Disabled Local Group Member Removed",LOW,NA
652,Security,"Windows (2000 XP) and Windows Server (2003)",,"Security Disabled Local Group Deleted",LOW,NA
653,Security,"Windows (2000 XP) and Windows Server (2003)",,"Security Disabled Global Group Created",LOW,NA
654,Security,"Windows (2000 XP) and Windows Server (2003)",,"Security Disabled Global Group Changed",LOW,NA
655,Security,"Windows (2000 XP) and Windows Server (2003)",,"Security Disabled Global Group Member Added",LOW,NA
656,Security,"Windows (2000 XP) and Windows Server (2003)",,"Security Disabled Global Group Member Removed",LOW,NA
657,Security,"Windows (2000 XP) and Windows Server (2003)",,"Security Disabled Global Group Deleted",LOW,NA
658,Security,"Windows (2000 XP) and Windows Server (2003)",,"Security Enabled Universal Group Created",LOW,NA
659,Security,"Windows (2000 XP) and Windows Server (2003)",,"Security Enabled Universal Group Changed",LOW,NA
660,Security,"Windows (2000 XP) and Windows Server (2003)",,"Security Enabled Universal Group Member Added",LOW,NA
661,Security,"Windows (2000 XP) and Windows Server (2003)",,"Security Enabled Universal Group Member Removed",LOW,NA
662,Security,"Windows (2000 XP) and Windows Server (2003)",,"Security Enabled Universal Group Deleted",LOW,NA
663,Security,"Windows (2000 XP) and Windows Server (2003)",,"Security Disabled Universal Group Created",LOW,NA
664,Security,"Windows (2000 XP) and Windows Server (2003)",,"Security Disabled Universal Group Changed",LOW,NA
665,Security,"Windows (2000 XP) and Windows Server (2003)",,"Security Disabled Universal Group Member Added",LOW,NA
666,Security,"Windows (2000 XP) and Windows Server (2003)",,"Security Disabled Universal Group Member Removed",LOW,NA
667,Security,"Windows (2000 XP) and Windows Server (2003)",,"Security Disabled Universal Group Deleted",LOW,NA
668,Security,"Windows (2000 XP) and Windows Server (2003)",,"Group Type Changed",LOW,NA
669,Security,"Windows (2000 XP) and Windows Server (2003)",,"Add SID History",LOW,NA
670,Security,"Windows (2000 XP) and Windows Server (2003)",,"Add SID History",LOW,NA
671,Security,"Windows (2000 XP) and Windows Server (2003)",,"User Account Unlocked",LOW,NA
672,Security,"Windows (2000 XP) and Windows Server (2003)",,"Authentication Ticket Granted",LOW,NA
673,Security,"Windows (2000 XP) and Windows Server (2003)",,"Service Ticket Granted",LOW,NA
674,Security,"Windows (2000 XP) and Windows Server (2003)",,"Ticket Granted Renewed",LOW,NA
675,Security,"Windows (2000 XP) and Windows Server (2003)",,"Pre-authentication failed",LOW,Failed
676,Security,"Windows (2000 XP) and Windows Server (2003)",,"Authentication Ticket Request Failed",LOW,NA
677,Security,"Windows (2000 XP) and Windows Server (2003)",,"Service Ticket Request Failed",LOW,NA
678,Security,"Windows (2000 XP) and Windows Server (2003)",,"Account Mapped for Logon by",LOW,NA
679,Security,"Windows (2000 XP) and Windows Server (2003)",,"The name: %2 could not be mapped for logon by: %1",LOW,NA
680,Security,"Windows (2000 XP) and Windows Server (2003)",,"Account Used for Logon by",LOW,NA
681,Security,"Windows (2000 XP) and Windows Server (2003)",,"The logon to account: %2 by: %1 from workstation: %3 failed.",LOW,Failed
682,Security,"Windows (2000 XP) and Windows Server (2003)",,"Session reconnected to winstation",LOW,NA
683,Security,"Windows (2000 XP) and Windows Server (2003)",,"Session disconnected from winstation",LOW,NA
684,Security,"Windows (2000 XP) and Windows Server (2003)",,"Set ACLs of members in administrators groups",LOW,NA
685,Security,"Windows (2000 XP) and Windows Server (2003)",,"Account Name Changed",LOW,NA
686,Security,"Windows (2000 XP) and Windows Server (2003)",,"Password of the following user accessed",LOW,NA
687,Security,"Windows (2000 XP) and Windows Server (2003)",,"Basic Application Group Created",LOW,NA
688,Security,"Windows (2000 XP) and Windows Server (2003)",,"Basic Application Group Changed",LOW,NA
689,Security,"Windows (2000 XP) and Windows Server (2003)",,"Basic Application Group Member Added",LOW,NA
690,Security,"Windows (2000 XP) and Windows Server (2003)",,"Basic Application Group Member Removed",LOW,NA
691,Security,"Windows (2000 XP) and Windows Server (2003)",,"Basic Application Group Non-Member Added",LOW,NA
692,Security,"Windows (2000 XP) and Windows Server (2003)",,"Basic Application Group Non-Member Removed",LOW,NA
693,Security,"Windows (2000 XP) and Windows Server (2003)",,"Basic Application Group Deleted",LOW,NA
694,Security,"Windows (2000 XP) and Windows Server (2003)",,"LDAP Query Group Created",LOW,NA
695,Security,"Windows (2000 XP) and Windows Server (2003)",,"LDAP Query Group Changed",LOW,NA
696,Security,"Windows (2000 XP) and Windows Server (2003)",,"LDAP Query Group Deleted",LOW,NA
697,Security,"Windows (2000 XP) and Windows Server (2003)",,"Password Policy Checking API is called",LOW,NA
806,Security,"Windows (2000 XP) and Windows Server (2003)",,"Per User Audit Policy was refreshed",LOW,NA
807,Security,"Windows (2000 XP) and Windows Server (2003)",,"Per user auditing policy set for user",LOW,NA
808,Security,"Windows (2000 XP) and Windows Server (2003)",,"A security event source has attempted to register",LOW,NA
809,Security,"Windows (2000 XP) and Windows Server (2003)",,"A security event source has attempted to unregister",LOW,NA
848,Security,"Windows (2000 XP) and Windows Server (2003)",,"The following policy was active when the Windows Firewall started",LOW,NA
849,Security,"Windows (2000 XP) and Windows Server (2003)",,"An application was listed as an exception when the Windows Firewall started",LOW,NA
850,Security,"Windows (2000 XP) and Windows Server (2003)",,"A port was listed as an exception when the Windows Firewall started",LOW,NA
851,Security,"Windows (2000 XP) and Windows Server (2003)",,"A change has been made to the Windows Firewall application exception list",LOW,NA
852,Security,"Windows (2000 XP) and Windows Server (2003)",,"A change has been made to the Windows Firewall port exception list",LOW,NA
853,Security,"Windows (2000 XP) and Windows Server (2003)",,"The Windows Firewall operational mode has changed",LOW,NA
854,Security,"Windows (2000 XP) and Windows Server (2003)",,"The Windows Firewall logging settings have changed",LOW,NA
855,Security,"Windows (2000 XP) and Windows Server (2003)",,"A Windows Firewall ICMP setting has changed",LOW,NA
856,Security,"Windows (2000 XP) and Windows Server (2003)",,"The Windows Firewall setting to allow unicast responses to multicast/broadcast traffic has changed",LOW,NA
857,Security,"Windows (2000 XP) and Windows Server (2003)",,"The Windows Firewall setting to allow remote administration allowing port TCP 135 and DCOM/RPC has changed",LOW,NA
858,Security,"Windows (2000 XP) and Windows Server (2003)",,"Windows Firewall group policy settings have been applied",LOW,NA
859,Security,"Windows (2000 XP) and Windows Server (2003)",,"The Windows Firewall group policy settings have been removed",LOW,NA
860,Security,"Windows (2000 XP) and Windows Server (2003)",,"The Windows Firewall has switched the active policy profile",LOW,NA
861,Security,"Windows (2000 XP) and Windows Server (2003)",,"The Windows Firewall has detected an application listening for incoming traffic",LOW,NA
1100,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The event logging service has shut down",LOW,NA
1101,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Audit events have been dropped by the transport.",LOW,NA
1102,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The audit log was cleared",HIGH,NA
1104,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The security Log is now full",HIGH,NA
1105,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Event log automatic backup",LOW,NA
1108,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The event logging service encountered an error",LOW,NA
4608,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Windows is starting up",LOW,NA
4609,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Windows is shutting down",LOW,NA
4610,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An authentication package has been loaded by the Local Security Authority",LOW,NA
4611,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A trusted logon process has been registered with the Local Security Authority",LOW,NA
4612,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Internal resources allocated for the queuing of audit messages have been exhausted leading to the loss of some audits.",LOW,NA
4614,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A notification package has been loaded by the Security Account Manager.",LOW,NA
4615,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Invalid use of LPC port",LOW,NA
4616,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The system time was changed.",LOW,NA
4618,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A monitored security event pattern has occurred",HIGH,NA
4621,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Administrator recovered system from CrashOnAuditFail",MEDIUM,NA
4622,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A security package has been loaded by the Local Security Authority.",LOW,NA
4624,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An account was successfully logged on",LOW,NA
4625,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An account failed to log on",LOW,Failed
4626,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"User/Device claims information",LOW,NA
4627,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Group membership information.",LOW,NA
4634,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An account was logged off",LOW,NA
4646,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"IKE DoS-prevention mode started",LOW,NA
4647,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"User initiated logoff",LOW,NA
4648,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A logon was attempted using explicit credentials",LOW,NA
4649,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A replay attack was detected",HIGH,NA
4650,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An IPsec Main Mode security association was established",LOW,NA
4651,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An IPsec Main Mode security association was established",LOW,NA
4652,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An IPsec Main Mode negotiation failed",LOW,Failed
4653,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An IPsec Main Mode negotiation failed",LOW,Failed
4654,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An IPsec Quick Mode negotiation failed",LOW,Failed
4655,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An IPsec Main Mode security association ended",LOW,NA
4656,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A handle to an object was requested",LOW,NA
4657,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A registry value was modified",LOW,NA
4658,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The handle to an object was closed",LOW,NA
4659,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A handle to an object was requested with intent to delete",LOW,NA
4660,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An object was deleted",LOW,NA
4661,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A handle to an object was requested",LOW,NA
4662,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An operation was performed on an object",LOW,NA
4663,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An attempt was made to access an object",LOW,NA
4664,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An attempt was made to create a hard link",LOW,NA
4665,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An attempt was made to create an application client context.",LOW,NA
4666,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An application attempted an operation",LOW,NA
4667,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An application client context was deleted",LOW,NA
4668,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An application was initialized",LOW,NA
4670,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Permissions on an object were changed",LOW,NA
4671,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An application attempted to access a blocked ordinal through the TBS",LOW,NA
4672,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Special privileges assigned to new logon",LOW,NA
4673,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A privileged service was called",LOW,NA
4674,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An operation was attempted on a privileged object",LOW,NA
4675,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"SIDs were filtered",MEDIUM,NA
4688,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A new process has been created",LOW,NA
4689,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A process has exited",LOW,NA
4690,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An attempt was made to duplicate a handle to an object",LOW,NA
4691,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Indirect access to an object was requested",LOW,NA
4692,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Backup of data protection master key was attempted",MEDIUM,NA
4693,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Recovery of data protection master key was attempted",MEDIUM,NA
4694,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Protection of auditable protected data was attempted",LOW,NA
4695,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Unprotection of auditable protected data was attempted",LOW,NA
4696,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A primary token was assigned to process",LOW,NA
4697,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A service was installed in the system",LOW,NA
4698,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A scheduled task was created",LOW,NA
4699,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A scheduled task was deleted",LOW,NA
4700,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A scheduled task was enabled",LOW,NA
4701,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A scheduled task was disabled",LOW,NA
4702,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A scheduled task was updated",LOW,NA
4703,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A token right was adjusted",LOW,NA
4704,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A user right was assigned",LOW,NA
4705,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A user right was removed",LOW,NA
4706,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A new trust was created to a domain",MEDIUM,NA
4707,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A trust to a domain was removed",LOW,NA
4709,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"IPsec Services was started",LOW,NA
4710,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"IPsec Services was disabled",LOW,NA
4711,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"PAStore Engine (1%)",LOW,NA
4712,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"IPsec Services encountered a potentially serious failure",LOW,Failed
4713,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Kerberos policy was changed",MEDIUM,NA
4714,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Encrypted data recovery policy was changed",MEDIUM,NA
4715,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The audit policy (SACL) on an object was changed",MEDIUM,NA
4716,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Trusted domain information was modified",MEDIUM,NA
4717,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"System security access was granted to an account",LOW,NA
4718,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"System security access was removed from an account",LOW,NA
4719,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"System audit policy was changed",HIGH,NA
4720,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A user account was created",LOW,NA
4722,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A user account was enabled",LOW,NA
4723,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An attempt was made to change an account’s password",LOW,NA
4724,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An attempt was made to reset an accounts password",MEDIUM,NA
4725,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A user account was disabled",LOW,NA
4726,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A user account was deleted",LOW,NA
4727,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A security-enabled global group was created",MEDIUM,NA
4728,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A member was added to a security-enabled global group",LOW,NA
4729,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A member was removed from a security-enabled global group",LOW,NA
4730,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A security-enabled global group was deleted",LOW,NA
4731,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A security-enabled local group was created",LOW,NA
4732,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A member was added to a security-enabled local group",LOW,NA
4733,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A member was removed from a security-enabled local group",LOW,NA
4734,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A security-enabled local group was deleted",LOW,NA
4735,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A security-enabled local group was changed",MEDIUM,NA
4737,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A security-enabled global group was changed",MEDIUM,NA
4738,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A user account was changed",LOW,NA
4739,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Domain Policy was changed",MEDIUM,NA
4740,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A user account was locked out",LOW,NA
4741,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A computer account was created",LOW,NA
4742,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A computer account was changed",LOW,NA
4743,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A computer account was deleted",LOW,NA
4744,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A security-disabled local group was created",LOW,NA
4745,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A security-disabled local group was changed",LOW,NA
4746,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A member was added to a security-disabled local group",LOW,NA
4747,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A member was removed from a security-disabled local group",LOW,NA
4748,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A security-disabled local group was deleted",LOW,NA
4749,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A security-disabled global group was created",LOW,NA
4750,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A security-disabled global group was changed",LOW,NA
4751,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A member was added to a security-disabled global group",LOW,NA
4752,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A member was removed from a security-disabled global group",LOW,NA
4753,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A security-disabled global group was deleted",LOW,NA
4754,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A security-enabled universal group was created",MEDIUM,NA
4755,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A security-enabled universal group was changed",MEDIUM,NA
4756,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A member was added to a security-enabled universal group",LOW,NA
4756,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"User Added to Privileged Group",LOW,NA
4757,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A member was removed from a security-enabled universal group",LOW,NA
4758,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A security-enabled universal group was deleted",LOW,NA
4759,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A security-disabled universal group was created",LOW,NA
4760,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A security-disabled universal group was changed",LOW,NA
4761,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A member was added to a security-disabled universal group",LOW,NA
4762,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A member was removed from a security-disabled universal group",LOW,NA
4763,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A security-disabled universal group was deleted",LOW,NA
4764,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A groups type was changed",MEDIUM,NA
4765,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"SID History was added to an account",HIGH,NA
4766,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An attempt to add SID History to an account failed",HIGH,Failed
4767,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A user account was unlocked",LOW,NA
4768,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A Kerberos authentication ticket (TGT) was requested",LOW,NA
4769,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A Kerberos service ticket was requested",LOW,NA
4770,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A Kerberos service ticket was renewed",LOW,NA
4771,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Kerberos pre-authentication failed",LOW,Failed
4772,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A Kerberos authentication ticket request failed",LOW,Failed
4773,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A Kerberos service ticket request failed",LOW,Failed
4774,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An account was mapped for logon",LOW,NA
4775,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An account could not be mapped for logon",LOW,NA
4776,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The domain controller attempted to validate the credentials for an account",LOW,NA
4777,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The domain controller failed to validate the credentials for an account",LOW,Failed
4778,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A session was reconnected to a Window Station",LOW,NA
4779,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A session was disconnected from a Window Station",LOW,NA
4780,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The ACL was set on accounts which are members of administrators groups",MEDIUM,NA
4781,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The name of an account was changed",LOW,NA
4782,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The password hash an account was accessed",LOW,NA
4783,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A basic application group was created",LOW,NA
4784,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A basic application group was changed",LOW,NA
4785,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A member was added to a basic application group",LOW,NA
4786,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A member was removed from a basic application group",LOW,NA
4787,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A non-member was added to a basic application group",LOW,NA
4788,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A non-member was removed from a basic application group..",LOW,NA
4789,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A basic application group was deleted",LOW,NA
4790,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An LDAP query group was created",LOW,NA
4791,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A basic application group was changed",LOW,NA
4792,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An LDAP query group was deleted",LOW,NA
4793,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The Password Policy Checking API was called",LOW,NA
4794,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An attempt was made to set the Directory Services Restore Mode administrator password",HIGH,NA
4797,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An attempt was made to query the existence of a blank password for an account",LOW,NA
4798,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A user’s local group membership was enumerated.",LOW,NA
4799,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A security-enabled local group membership was enumerated",LOW,NA
4800,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The workstation was locked",LOW,NA
4801,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The workstation was unlocked",LOW,NA
4802,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The screen saver was invoked",LOW,NA
4803,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The screen saver was dismissed",LOW,NA
4816,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"RPC detected an integrity violation while decrypting an incoming message",MEDIUM,NA
4817,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Auditing settings on object were changed.",LOW,NA
4818,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Proposed Central Access Policy does not grant the same access permissions as the current Central Access Policy",LOW,NA
4819,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Central Access Policies on the machine have been changed",LOW,NA
4820,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A Kerberos Ticket-granting-ticket (TGT) was denied because the device does not meet the access control restrictions",LOW,NA
4821,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A Kerberos service ticket was denied because the user device or both does not meet the access control restrictions",LOW,NA
4822,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"NTLM authentication failed because the account was a member of the Protected User group",LOW,Failed
4823,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"NTLM authentication failed because access control restrictions are required",LOW,Failed
4824,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Kerberos preauthentication by using DES or RC4 failed because the account was a member of the Protected User group",LOW,Failed
4825,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A user was denied the access to Remote Desktop. By default users are allowed to connect only if they are members of the Remote Desktop Users group or Administrators group",LOW,NA
4826,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Boot Configuration Data loaded",LOW,NA
4830,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"SID History was removed from an account",LOW,NA
4864,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A namespace collision was detected",LOW,NA
4865,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A trusted forest information entry was added",MEDIUM,NA
4866,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A trusted forest information entry was removed",MEDIUM,NA
4867,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A trusted forest information entry was modified",MEDIUM,NA
4868,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The certificate manager denied a pending certificate request",MEDIUM,NA
4869,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Certificate Services received a resubmitted certificate request",LOW,NA
4870,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Certificate Services revoked a certificate",MEDIUM,NA
4871,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Certificate Services received a request to publish the certificate revocation list (CRL)",LOW,NA
4872,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Certificate Services published the certificate revocation list (CRL)",LOW,NA
4873,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A certificate request extension changed",LOW,NA
4874,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"One or more certificate request attributes changed.",LOW,NA
4875,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Certificate Services received a request to shut down",LOW,NA
4876,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Certificate Services backup started",LOW,NA
4877,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Certificate Services backup completed",LOW,NA
4878,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Certificate Services restore started",LOW,NA
4879,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Certificate Services restore completed",LOW,NA
4880,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Certificate Services started",LOW,NA
4881,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Certificate Services stopped",LOW,NA
4882,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The security permissions for Certificate Services changed",MEDIUM,NA
4883,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Certificate Services retrieved an archived key",LOW,NA
4884,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Certificate Services imported a certificate into its database",LOW,NA
4885,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The audit filter for Certificate Services changed",MEDIUM,NA
4886,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Certificate Services received a certificate request",LOW,NA
4887,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Certificate Services approved a certificate request and issued a certificate",LOW,NA
4888,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Certificate Services denied a certificate request",LOW,NA
4889,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Certificate Services set the status of a certificate request to pending",LOW,NA
4890,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The certificate manager settings for Certificate Services changed.",MEDIUM,NA
4891,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A configuration entry changed in Certificate Services",LOW,NA
4892,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A property of Certificate Services changed",MEDIUM,NA
4893,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Certificate Services archived a key",LOW,NA
4894,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Certificate Services imported and archived a key",LOW,NA
4895,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Certificate Services published the CA certificate to Active Directory Domain Services",LOW,NA
4896,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"One or more rows have been deleted from the certificate database",MEDIUM,NA
4897,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Role separation enabled",HIGH,NA
4898,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Certificate Services loaded a template",LOW,NA
4899,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A Certificate Services template was updated",LOW,NA
4900,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Certificate Services template security was updated",LOW,NA
4902,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The Per-user audit policy table was created",LOW,NA
4904,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An attempt was made to register a security event source",LOW,NA
4905,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An attempt was made to unregister a security event source",LOW,NA
4906,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The CrashOnAuditFail value has changed",MEDIUM,NA
4907,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Auditing settings on object were changed",MEDIUM,NA
4908,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Special Groups Logon table modified",MEDIUM,NA
4909,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The local policy settings for the TBS were changed",LOW,NA
4910,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The group policy settings for the TBS were changed",LOW,NA
4911,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Resource attributes of the object were changed",LOW,NA
4912,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Per User Audit Policy was changed",MEDIUM,NA
4913,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Central Access Policy on the object was changed",LOW,NA
4928,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An Active Directory replica source naming context was established",LOW,NA
4929,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An Active Directory replica source naming context was removed",LOW,NA
4930,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An Active Directory replica source naming context was modified",LOW,NA
4931,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An Active Directory replica destination naming context was modified",LOW,NA
4932,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Synchronization of a replica of an Active Directory naming context has begun",LOW,NA
4933,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Synchronization of a replica of an Active Directory naming context has ended",LOW,NA
4934,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Attributes of an Active Directory object were replicated",LOW,NA
4935,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Replication failure begins",LOW,Failed
4936,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Replication failure ends",LOW,Failed
4937,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A lingering object was removed from a replica",LOW,NA
4944,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The following policy was active when the Windows Firewall started",LOW,NA
4945,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A rule was listed when the Windows Firewall started",LOW,NA
4946,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A change has been made to Windows Firewall exception list. A rule was added",LOW,NA
4947,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A change has been made to Windows Firewall exception list. A rule was modified",LOW,NA
4948,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A change has been made to Windows Firewall exception list. A rule was deleted",LOW,NA
4949,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Windows Firewall settings were restored to the default values",LOW,NA
4950,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A Windows Firewall setting has changed",LOW,NA
4951,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A rule has been ignored because its major version number was not recognized by Windows Firewall",LOW,NA
4952,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Parts of a rule have been ignored because its minor version number was not recognized by Windows Firewall",LOW,NA
4953,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A rule has been ignored by Windows Firewall because it could not parse the rule",LOW,NA
4954,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Windows Firewall Group Policy settings has changed. The new settings have been applied",LOW,NA
4956,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Windows Firewall has changed the active profile",LOW,NA
4957,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Windows Firewall did not apply the following rule",LOW,NA
4958,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Windows Firewall did not apply the following rule because the rule referred to items not configured on this computer",LOW,NA
4960,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"IPsec dropped an inbound packet that failed an integrity check",MEDIUM,Failed
4961,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"IPsec dropped an inbound packet that failed a replay check",MEDIUM,Failed
4962,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"IPsec dropped an inbound packet that failed a replay check",MEDIUM,Failed
4963,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"IPsec dropped an inbound clear text packet that should have been secured",MEDIUM,NA
4964,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Special groups have been assigned to a new logon",HIGH,NA
4965,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"IPsec received a packet from a remote computer with an incorrect Security Parameter Index (SPI).",MEDIUM,NA
4976,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"During Main Mode negotiation IPsec received an invalid negotiation packet.",MEDIUM,NA
4977,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"During Quick Mode negotiation  IPsec received an invalid negotiation packet.",MEDIUM,NA
4978,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"During Extended Mode negotiation IPsec received an invalid negotiation packet.",MEDIUM,NA
4979,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"IPsec Main Mode and Extended Mode security associations were established.",LOW,NA
4980,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"IPsec Main Mode and Extended Mode security associations were established",LOW,NA
4981,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"IPsec Main Mode and Extended Mode security associations were established",LOW,NA
4982,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"IPsec Main Mode and Extended Mode security associations were established",LOW,NA
4983,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An IPsec Extended Mode negotiation failed",MEDIUM,Failed
4984,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An IPsec Extended Mode negotiation failed",MEDIUM,Failed
4985,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The state of a transaction has changed",LOW,NA
5024,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The Windows Firewall Service has started successfully",LOW,NA
5025,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The Windows Firewall Service has been stopped",LOW,NA
5027,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The Windows Firewall Service was unable to retrieve the security policy from the local storage",MEDIUM,NA
5028,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The Windows Firewall Service was unable to parse the new security policy.",MEDIUM,NA
5029,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The Windows Firewall Service failed to initialize the driver",MEDIUM,Failed
5030,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The Windows Firewall Service failed to start",MEDIUM,Failed
5031,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The Windows Firewall Service blocked an application from accepting incoming connections on the network.",LOW,NA
5032,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network",LOW,NA
5033,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The Windows Firewall Driver has started successfully",LOW,NA
5034,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The Windows Firewall Driver has been stopped",LOW,NA
5035,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The Windows Firewall Driver failed to start",MEDIUM,Failed
5037,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The Windows Firewall Driver detected critical runtime error. Terminating",MEDIUM,NA
5038,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Code integrity determined that the image hash of a file is not valid",MEDIUM,NA
5039,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A registry key was virtualized.",LOW,NA
5040,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A change has been made to IPsec settings. An Authentication Set was added.",LOW,NA
5041,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A change has been made to IPsec settings. An Authentication Set was modified",LOW,NA
5042,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A change has been made to IPsec settings. An Authentication Set was deleted",LOW,NA
5043,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A change has been made to IPsec settings. A Connection Security Rule was added",LOW,NA
5044,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A change has been made to IPsec settings. A Connection Security Rule was modified",LOW,NA
5045,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A change has been made to IPsec settings. A Connection Security Rule was deleted",LOW,NA
5046,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A change has been made to IPsec settings. A Crypto Set was added",LOW,NA
5047,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A change has been made to IPsec settings. A Crypto Set was modified",LOW,NA
5048,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A change has been made to IPsec settings. A Crypto Set was deleted",LOW,NA
5049,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An IPsec Security Association was deleted",LOW,NA
5050,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An attempt to programmatically disable the Windows Firewall using a call to INetFwProfile.FirewallEnabled(FALSE",LOW,NA
5051,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A file was virtualized",LOW,NA
5056,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A cryptographic self test was performed",LOW,NA
5057,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A cryptographic primitive operation failed",LOW,Failed
5058,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Key file operation",LOW,NA
5059,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Key migration operation",LOW,NA
5060,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Verification operation failed",LOW,Failed
5061,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Cryptographic operation",LOW,NA
5062,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A kernel-mode cryptographic self test was performed",LOW,NA
5063,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A cryptographic provider operation was attempted",LOW,NA
5064,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A cryptographic context operation was attempted",LOW,NA
5065,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A cryptographic context modification was attempted",LOW,NA
5066,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A cryptographic function operation was attempted",LOW,NA
5067,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A cryptographic function modification was attempted",LOW,NA
5068,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A cryptographic function provider operation was attempted",LOW,NA
5069,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A cryptographic function property operation was attempted",LOW,NA
5070,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A cryptographic function property operation was attempted",LOW,NA
5071,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Key access denied by Microsoft key distribution service",LOW,NA
5120,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"OCSP Responder Service Started",MEDIUM,NA
5121,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"OCSP Responder Service Stopped",MEDIUM,NA
5122,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A Configuration entry changed in the OCSP Responder Service",MEDIUM,NA
5123,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A configuration entry changed in the OCSP Responder Service",MEDIUM,NA
5124,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A security setting was updated on OCSP Responder Service",HIGH,NA
5125,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A request was submitted to OCSP Responder Service",LOW,NA
5126,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Signing Certificate was automatically updated by the OCSP Responder Service",LOW,NA
5127,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The OCSP Revocation Provider successfully updated the revocation information",LOW,NA
5136,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A directory service object was modified",LOW,NA
5137,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A directory service object was created",LOW,NA
5138,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A directory service object was undeleted",LOW,NA
5139,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A directory service object was moved",LOW,NA
5140,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A network share object was accessed",LOW,NA
5141,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A directory service object was deleted",LOW,NA
5142,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A network share object was added.",LOW,NA
5143,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A network share object was modified",LOW,NA
5144,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A network share object was deleted.",LOW,NA
5145,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A network share object was checked to see whether client can be granted desired access",LOW,NA
5146,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The Windows Filtering Platform has blocked a packet",LOW,NA
5147,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A more restrictive Windows Filtering Platform filter has blocked a packet",LOW,NA
5148,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The Windows Filtering Platform has detected a DoS attack and entered a defensive mode",LOW,NA
5149,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The DoS attack has subsided and normal processing is being resumed.",LOW,NA
5150,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The Windows Filtering Platform has blocked a packet.",LOW,NA
5151,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A more restrictive Windows Filtering Platform filter has blocked a packet.",LOW,NA
5152,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The Windows Filtering Platform blocked a packet",LOW,NA
5153,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A more restrictive Windows Filtering Platform filter has blocked a packet",LOW,NA
5154,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections",LOW,NA
5155,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections",LOW,NA
5156,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The Windows Filtering Platform has allowed a connection",LOW,NA
5157,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The Windows Filtering Platform has blocked a connection",LOW,NA
5158,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The Windows Filtering Platform has permitted a bind to a local port",LOW,NA
5159,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The Windows Filtering Platform has blocked a bind to a local port",LOW,NA
5168,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Spn check for SMB/SMB2 fails.",LOW,Failed
5169,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A directory service object was modified",LOW,NA
5170,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A directory service object was modified during a background cleanup task",LOW,NA
5376,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Credential Manager credentials were backed up",MEDIUM,NA
5377,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Credential Manager credentials were restored from a backup",MEDIUM,NA
5378,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The requested credentials delegation was disallowed by policy",LOW,NA
5379,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Credential Manager credentials were read",LOW,NA
5380,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Vault Find Credential",LOW,NA
5381,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Vault credentials were read",LOW,NA
5382,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Vault credentials were read",LOW,NA
5440,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The following callout was present when the Windows Filtering Platform Base Filtering Engine started",LOW,NA
5441,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The following filter was present when the Windows Filtering Platform Base Filtering Engine started",LOW,NA
5442,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The following provider was present when the Windows Filtering Platform Base Filtering Engine started",LOW,NA
5443,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The following provider context was present when the Windows Filtering Platform Base Filtering Engine started",LOW,NA
5444,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The following sub-layer was present when the Windows Filtering Platform Base Filtering Engine started",LOW,NA
5446,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A Windows Filtering Platform callout has been changed",LOW,NA
5447,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A Windows Filtering Platform filter has been changed",LOW,NA
5448,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A Windows Filtering Platform provider has been changed",LOW,NA
5449,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A Windows Filtering Platform provider context has been changed",LOW,NA
5450,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A Windows Filtering Platform sub-layer has been changed",LOW,NA
5451,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An IPsec Quick Mode security association was established",LOW,NA
5452,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An IPsec Quick Mode security association ended",LOW,NA
5453,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An IPsec negotiation with a remote computer failed because the IKE and AuthIP IPsec Keying Modules (IKEEXT) service is not started",MEDIUM,Failed
5456,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"PAStore Engine applied Active Directory storage IPsec policy on the computer",LOW,NA
5457,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"PAStore Engine failed to apply Active Directory storage IPsec policy on the computer",LOW,Failed
5458,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"PAStore Engine applied locally cached copy of Active Directory storage IPsec policy on the computer",LOW,NA
5459,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"PAStore Engine failed to apply locally cached copy of Active Directory storage IPsec policy on the computer",LOW,Failed
5460,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"PAStore Engine applied local registry storage IPsec policy on the computer",LOW,NA
5461,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"PAStore Engine failed to apply local registry storage IPsec policy on the computer",LOW,Failed
5462,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"PAStore Engine failed to apply some rules of the active IPsec policy on the computer",LOW,Failed
5463,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"PAStore Engine polled for changes to the active IPsec policy and detected no changes",LOW,NA
5464,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"PAStore Engine polled for changes to the active IPsec policy detected changes and applied them to IPsec Services",LOW,NA
5465,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"PAStore Engine received a control for forced reloading of IPsec policy and processed the control successfully",LOW,NA
5466,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"PAStore Engine polled for changes to the Active Directory IPsec policy determined that Active Directory cannot be reached and will use the cached copy of the Active Directory IPsec policy instead",LOW,NA
5467,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"PAStore Engine polled for changes to the Active Directory IPsec policy determined that Active Directory can be reached and found no changes to the policy",LOW,NA
5468,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"PAStore Engine polled for changes to the Active Directory IPsec policy determined that Active Directory can be reached found changes to the policy and applied those changes",LOW,NA
5471,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"PAStore Engine loaded local storage IPsec policy on the computer",LOW,NA
5472,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"PAStore Engine failed to load local storage IPsec policy on the computer",LOW,Failed
5473,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"PAStore Engine loaded directory storage IPsec policy on the computer",LOW,NA
5474,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"PAStore Engine failed to load directory storage IPsec policy on the computer",LOW,Failed
5477,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"PAStore Engine failed to add quick mode filter",LOW,Failed
5478,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"IPsec Services has started successfully",LOW,NA
5479,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"IPsec Services has been shut down successfully",LOW,NA
5480,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"IPsec Services failed to get the complete list of network interfaces on the computer",MEDIUM,Failed
5483,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"IPsec Services failed to initialize RPC server. IPsec Services could not be started",MEDIUM,Failed
5484,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"IPsec Services has experienced a critical failure and has been shut down",MEDIUM,Failed
5485,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"IPsec Services failed to process some IPsec filters on a plug-and-play event for network interfaces",MEDIUM,Failed
5632,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A request was made to authenticate to a wireless network",LOW,NA
5633,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A request was made to authenticate to a wired network",LOW,NA
5712,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A Remote Procedure Call (RPC) was attempted",LOW,NA
5888,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An object in the COM+ Catalog was modified",LOW,NA
5889,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An object was deleted from the COM+ Catalog",LOW,NA
5890,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An object was added to the COM+ Catalog",LOW,NA
6144,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Security policy in the group policy objects has been applied successfully",LOW,NA
6145,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"One or more errors occured while processing security policy in the group policy objects",MEDIUM,NA
6272,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Network Policy Server granted access to a user",LOW,NA
6273,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Network Policy Server denied access to a user",MEDIUM,NA
6274,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Network Policy Server discarded the request for a user",MEDIUM,NA
6275,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Network Policy Server discarded the accounting request for a user",MEDIUM,NA
6276,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Network Policy Server quarantined a user",MEDIUM,NA
6277,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Network Policy Server granted access to a user but put it on probation because the host did not meet the defined health policy",MEDIUM,NA
6278,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Network Policy Server granted full access to a user because the host met the defined health policy",MEDIUM,NA
6279,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Network Policy Server locked the user account due to repeated failed authentication attempts",MEDIUM,Failed
6280,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Network Policy Server unlocked the user account",MEDIUM,NA
6281,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Code Integrity determined that the page hashes of an image file are not valid…",LOW,NA
6400,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"BranchCache: Received an incorrectly formatted response while discovering availability of content.",LOW,NA
6401,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"BranchCache: Received invalid data from a peer. Data discarded.",LOW,NA
6402,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"BranchCache: The message to the hosted cache offering it data is incorrectly formatted.",LOW,NA
6403,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"BranchCache: The hosted cache sent an incorrectly formatted response to the client’s message to offer it data.",LOW,NA
6404,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"BranchCache: Hosted cache could not be authenticated using the provisioned SSL certificate.",LOW,NA
6405,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"BranchCache: %2 instance(s) of event id %1 occurred.",LOW,NA
6406,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"%1 registered to Windows Firewall to control filtering for the following:",LOW,NA
6407,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"%1 registered to Windows Firewall to control filtering for the following:",LOW,NA
6408,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Registered product %1 failed and Windows Firewall is now controlling the filtering for %2.",LOW,Failed
6409,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"BranchCache: A service connection point object could not be parsed",LOW,NA
6410,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Code integrity determined that a file does not meet the security requirements to load into a process. This could be due to the use of shared sections or other issues",LOW,NA
6416,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A new external device was recognized by the system.",LOW,NA
6417,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The FIPS mode crypto selftests succeeded",LOW,NA
6418,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The FIPS mode crypto selftests failed",LOW,Failed
6419,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A request was made to disable a device",LOW,NA
6420,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A device was disabled",LOW,NA
6421,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A request was made to enable a device",LOW,NA
6422,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"A device was enabled",LOW,NA
6423,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The installation of this device is forbidden by system policy",LOW,NA
6424,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The installation of this device was allowed after having previously been forbidden by policy",LOW,NA
8191,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Highest System-Defined Audit Message Value",LOW,NA
24577,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Encryption of volume started",LOW,NA
24578,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Encryption of volume stopped",LOW,NA
24579,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Encryption of volume completed",LOW,NA
24580,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Decryption of volume started",LOW,NA
24581,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Decryption of volume stopped",LOW,NA
24582,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Decryption of volume completed",LOW,NA
24583,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Conversion worker thread for volume started",LOW,NA
24584,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Conversion worker thread for volume temporarily stopped",LOW,NA
24586,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An error was encountered converting volume",MEDIUM,NA
24588,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"The conversion operation on volume %2 encountered a bad sector error. Please validate the data on this volume",LOW,NA
24592,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"An attempt to automatically restart conversion on volume %2 failed.",MEDIUM,Failed
24593,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Metadata write: Volume %2 returning errors while trying to modify metadata. If failures continue, decrypt volume",MEDIUM,Failed
24594,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Metadata rebuild: An attempt to write a copy of metadata on volume %2 failed and may appear as disk corruption. If failures continue, decrypt volume.",MEDIUM,Failed
24595,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Volume %2 contains bad clusters. These clusters will be skipped during conversion.",LOW,NA
24621,Security,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Initial state check: Rolling volume conversion transaction on %2.",LOW,NA
2,Setup,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Update Packages Installed",LOW,NA
1009,Setup,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Hotpatching Failed",LOW,NA
6,System,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"New Kernel Filter Driver",LOW,NA
19,System,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Windows Update Installed",LOW,NA
104,System,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Event Log was Cleared",HIGH,NA
219,System,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Failed Kernel Driver Loading",LOW,NA
1001,System,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,BSOD,LOW,NA
1125,System,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Internal Error",LOW,Error
1127,System,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Generic Internal Error",LOW,Error
1129,System,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Group Policy Application Failed due to Connectivity",LOW,NA
7022,System,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Windows Service Fails or Crashes",LOW,NA
7023,System,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Windows Service Fails or Crashes",LOW,NA
7024,System,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Windows Service Fails or Crashes",LOW,NA
7026,System,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Windows Service Fails or Crashes",LOW,NA
7031,System,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Windows Service Fails or Crashes",LOW,NA
7032,System,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Windows Service Fails or Crashes",LOW,NA
7034,System,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"Windows Service Fails or Crashes",LOW,NA
7045,System,"Windows 7-Vista(8 10) - Windows Server (2008 2012R2 2016 2019)",,"New Windows Service",LOW,NA
