Deploiement_Server/deployment-apps/DA-ITSI-CP-windows-dashboards/lookups/windows_event_descriptions.csv

1	LogName	EventCode	EventCodeDescription
2	Security	10	Noise Entry
3	Security	512	Windows NT is starting up
4	Security	513	Windows is shutting down
5	Security	514	An authentication package has been loaded by the Local Security Authority
6	Security	515	A trusted logon process has registered with the Local Security Authority
7	Security	516	Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits
8	Security	517	The audit log was cleared
9	Security	518	A notification package has been loaded by the Security Account Manager
10	Security	519	A process is using an invalid local procedure call (LPC) port
11	Security	520	The system time was changed
12	Security	528	Successful Logon
13	Security	529	Logon Failure - Unknown user name or bad password
14	Security	530	Logon Failure - Account logon time restriction violation
15	Security	531	Logon Failure - Account currently disabled
16	Security	532	Logon Failure - The specified user account has expired
17	Security	533	Logon Failure - User not allowed to logon at this computer
18	Security	534	Logon Failure - The user has not been granted the requested logon type at this machine
19	Security	535	Logon Failure - The specified account's password has expired
20	Security	536	Logon Failure - The NetLogon component is not active
21	Security	537	Logon failure - The logon attempt failed for other reasons.
22	Security	538	User Logoff
23	Security	539	Logon Failure - Account locked out
24	Security	540	Successful Network Logon
25	Security	551	User initiated logoff
26	Security	552	Logon attempt using explicit credentials
27	Security	560	Object Open
28	Security	561	Handle Allocated
29	Security	562	Handle Closed
30	Security	563	Object Open for Delete
31	Security	564	Object Deleted
32	Security	565	Object Open (Active Directory)
33	Security	566	Object Operation (W3 Active Directory)
34	Security	567	Object Access Attempt
35	Security	576	Special privileges assigned to new logon
36	Security	577	Privileged Service Called
37	Security	578	Privileged object operation
38	Security	592	A new process has been created
39	Security	593	A process has exited
40	Security	594	A handle to an object has been duplicated
41	Security	595	Indirect access to an object has been obtained
42	Security	600	A process was assigned a primary token
43	Security	601	Attempt to install service
44	Security	602	Scheduled Task created
45	Security	608	User Right Assigned
46	Security	609	User Right Removed
47	Security	610	New Trusted Domain
48	Security	611	Removing Trusted Domain
49	Security	612	Audit Policy Change
50	Security	613	IPSec policy agent started
51	Security	614	IPSec policy agent disabled
52	Security	615	IPSEC PolicyAgent Service
53	Security	616	IPSec policy agent encountered a potentially serious failure.
54	Security	617	Kerberos Policy Changed
55	Security	618	Encrypted Data Recovery Policy Changed
56	Security	619	Quality of Service Policy Changed
57	Security	620	Trusted Domain Information Modified
58	Security	621	System Security Access Granted
59	Security	622	System Security Access Removed
60	Security	623	Per User Audit Policy was refreshed
61	Security	624	User Account Created
62	Security	625	User Account Type Changed
63	Security	626	User Account Enabled
64	Security	627	Change Password Attempt
65	Security	628	User Account password set
66	Security	629	User Account Disabled
67	Security	630	User Account Deleted
68	Security	631	Security Enabled Global Group Created
69	Security	632	Security Enabled Global Group Member Added
70	Security	633	Security Enabled Global Group Member Removed
71	Security	634	Security Enabled Global Group Deleted
72	Security	635	Security Enabled Local Group Created
73	Security	636	Security Enabled Local Group Member Added
74	Security	637	Security Enabled Local Group Member Removed
75	Security	638	Security Enabled Local Group Deleted
76	Security	639	Security Enabled Local Group Changed
77	Security	640	General Account Database Change
78	Security	641	Security Enabled Global Group Changed
79	Security	642	User Account Changed
80	Security	643	Domain Policy Changed
81	Security	644	User Account Locked Out
82	Security	645	Computer Account Created
83	Security	646	Computer Account Changed
84	Security	647	Computer Account Deleted
85	Security	648	Security Disabled Local Group Created
86	Security	649	Security Disabled Local Group Changed
87	Security	650	Security Disabled Local Group Member Added
88	Security	651	Security Disabled Local Group Member Removed
89	Security	652	Security Disabled Local Group Deleted
90	Security	653	Security Disabled Global Group Created
91	Security	654	Security Disabled Global Group Changed
92	Security	655	Security Disabled Global Group Member Added
93	Security	656	Security Disabled Global Group Member Removed
94	Security	657	Security Disabled Global Group Deleted
95	Security	658	Security Enabled Universal Group Created
96	Security	659	Security Enabled Universal Group Changed
97	Security	660	Security Enabled Universal Group Member Added
98	Security	661	Security Enabled Universal Group Member Removed
99	Security	662	Security Enabled Universal Group Deleted
100	Security	663	Security Disabled Universal Group Created
101	Security	664	Security Disabled Universal Group Changed
102	Security	665	Security Disabled Universal Group Member Added
103	Security	666	Security Disabled Universal Group Member Removed
104	Security	667	Security Disabled Universal Group Deleted
105	Security	668	Group Type Changed
106	Security	669	Add SID History
107	Security	670	Add SID History
108	Security	671	User Account Unlocked
109	Security	672	Authentication Ticket Granted
110	Security	673	Service Ticket Granted
111	Security	674	Ticket Granted Renewed
112	Security	675	Pre-authentication failed
113	Security	676	Authentication Ticket Request Failed
114	Security	677	Service Ticket Request Failed
115	Security	678	Account Mapped for Logon by
116	Security	679	The name: %2 could not be mapped for logon by: %1
117	Security	680	Account Used for Logon by
118	Security	681	The logon to account: %2 by: %1 from workstation: %3 failed.
119	Security	682	Session reconnected to winstation
120	Security	683	Session disconnected from winstation
121	Security	684	Set ACLs of members in administrators groups
122	Security	685	Account Name Changed
123	Security	686	Password of the following user accessed
124	Security	687	Basic Application Group Created
125	Security	688	Basic Application Group Changed
126	Security	689	Basic Application Group Member Added
127	Security	690	Basic Application Group Member Removed
128	Security	691	Basic Application Group Non-Member Added
129	Security	692	Basic Application Group Non-Member Removed
130	Security	693	Basic Application Group Deleted
131	Security	694	LDAP Query Group Created
132	Security	695	LDAP Query Group Changed
133	Security	696	LDAP Query Group Deleted
134	Security	697	Password Policy Checking API is called
135	Security	806	Per User Audit Policy was refreshed
136	Security	807	Per user auditing policy set for user
137	Security	808	A security event source has attempted to register
138	Security	809	A security event source has attempted to unregister
139	Security	848	The following policy was active when the Windows Firewall started
140	Security	849	An application was listed as an exception when the Windows Firewall started
141	Security	850	A port was listed as an exception when the Windows Firewall started
142	Security	851	A change has been made to Windows Firewall exception list
143	Security	852	A change has been made to the Windows Firewall port exception list
144	Security	854	A Windows Firewall setting has changed
145	Security	855	ICMP settings changed
146	Security	856	A rule has been partially ignored because its minor version number was not recognized by Windows Firewall
147	Security	857	A rule has been rejected by Windows Firewall
148	Security	858	The Windows Firewall group policy settings have been removed
149	Security	859	The Windows Firewall group policy settings have been removed
150	Security	860	The Windows Firewall has switched the active policy profile
151	Security	861	The Windows Firewall has detected an application listening for incoming traffic
152	Security	1100	The event logging service has shut down
153	Security	1101	Audit events have been dropped by the transport.
154	Security	1102	The audit log was cleared
155	Security	1104	The security Log is now full
156	Security	1105	Event log automatic backup
157	Security	1108	The event logging service encountered an error
158	Security	4500	Metabase Add Key
159	Security	4501	Metabase Delete Key
160	Security	4502	Metabase Delete Chid Keys
161	Security	4503	Metabase Copy Key
162	Security	4504	Metabase Rename Key
163	Security	4505	Metabase Set Data
164	Security	4506	Metabase Delete Data
165	Security	4507	Metabase Delete All Data
166	Security	4508	Metabase Copy Data
167	Security	4509	Metabase Set Last Change Time
168	Security	4510	Metabase Restore
169	Security	4511	Metabase Delete Backup
170	Security	4512	Metabase Import
171	Security	4608	Windows is starting up
172	Security	4609	Windows is shutting down
173	Security	4610	An authentication package has been loaded by the Local Security Authority
174	Security	4611	A trusted logon process has been registered with the Local Security Authority
175	Security	4612	Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits.
176	Security	4614	A notification package has been loaded by the Security Account Manager.
177	Security	4615	Invalid use of LPC port
178	Security	4616	The system time was changed.
179	Security	4618	A monitored security event pattern has occurred
180	Security	4621	Administrator recovered system from CrashOnAuditFail
181	Security	4622	A security package has been loaded by the Local Security Authority.
182	Security	4624	An account was successfully logged on
183	Security	4625	An account failed to log on
184	Security	4634	An account was logged off
185	Security	4646	IKE DoS-prevention mode started.
186	Security	4647	User initiated logoff
187	Security	4648	A logon was attempted using explicit credentials
188	Security	4649	A replay attack was detected
189	Security	4650	An IPsec Main Mode security association was established
190	Security	4651	An IPsec Main Mode security association was established
191	Security	4652	An IPsec Main Mode negotiation failed
192	Security	4653	An IPsec Main Mode negotiation failed
193	Security	4654	An IPsec Quick Mode negotiation failed
194	Security	4655	An IPsec Main Mode security association ended
195	Security	4656	A handle to an object was requested
196	Security	4657	A registry value was modified
197	Security	4658	The handle to an object was closed
198	Security	4659	A handle to an object was requested with intent to delete
199	Security	4660	An object was deleted
200	Security	4661	A handle to an object was requested
201	Security	4662	An operation was performed on an object
202	Security	4663	An attempt was made to access an object
203	Security	4664	An attempt was made to create a hard link
204	Security	4665	An attempt was made to create an application client context.
205	Security	4666	An application attempted an operation
206	Security	4667	An application client context was deleted
207	Security	4668	An application was initialized
208	Security	4670	Permissions on an object were changed
209	Security	4671	An application attempted to access a blocked ordinal through the TBS
210	Security	4672	Special privileges assigned to new logon
211	Security	4673	A privileged service was called
212	Security	4674	An operation was attempted on a privileged object
213	Security	4675	SIDs were filtered
214	Security	4688	A new process has been created
215	Security	4689	A process has exited
216	Security	4690	An attempt was made to duplicate a handle to an object
217	Security	4691	Indirect access to an object was requested
218	Security	4692	Backup of data protection master key was attempted
219	Security	4693	Recovery of data protection master key was attempted
220	Security	4694	Protection of auditable protected data was attempted
221	Security	4695	Unprotection of auditable protected data was attempted
222	Security	4696	A primary token was assigned to process
223	Security	4697	A service was installed in the system
224	Security	4698	A scheduled task was created
225	Security	4699	A scheduled task was deleted
226	Security	4700	A scheduled task was enabled
227	Security	4701	A scheduled task was disabled
228	Security	4702	A scheduled task was updated
229	Security	4704	A user right was assigned
230	Security	4705	A user right was removed
231	Security	4706	A new trust was created to a domain
232	Security	4707	A trust to a domain was removed
233	Security	4709	IPsec Services was started
234	Security	4710	IPsec Services was disabled
235	Security	4711	PAStore Engine (1%)
236	Security	4712	IPsec Services encountered a potentially serious failure
237	Security	4713	Kerberos policy was changed
238	Security	4714	Encrypted data recovery policy was changed
239	Security	4715	The audit policy (SACL) on an object was changed
240	Security	4716	Trusted domain information was modified
241	Security	4717	System security access was granted to an account
242	Security	4718	System security access was removed from an account
243	Security	4719	System audit policy was changed
244	Security	4720	A user account was created
245	Security	4722	A user account was enabled
246	Security	4723	An attempt was made to change an account's password
247	Security	4724	An attempt was made to reset an accounts password
248	Security	4725	A user account was disabled
249	Security	4726	A user account was deleted
250	Security	4727	A security-enabled global group was created
251	Security	4728	A member was added to a security-enabled global group
252	Security	4729	A member was removed from a security-enabled global group
253	Security	4730	A security-enabled global group was deleted
254	Security	4731	A security-enabled local group was created
255	Security	4732	A member was added to a security-enabled local group
256	Security	4733	A member was removed from a security-enabled local group
257	Security	4734	A security-enabled local group was deleted
258	Security	4735	A security-enabled local group was changed
259	Security	4737	A security-enabled global group was changed
260	Security	4738	A user account was changed
261	Security	4739	Domain Policy was changed
262	Security	4740	A user account was locked out
263	Security	4741	A computer account was created
264	Security	4742	A computer account was changed
265	Security	4743	A computer account was deleted
266	Security	4744	A security-disabled local group was created
267	Security	4745	A security-disabled local group was changed
268	Security	4746	A member was added to a security-disabled local group
269	Security	4747	A member was removed from a security-disabled local group
270	Security	4748	A security-disabled local group was deleted
271	Security	4749	A security-disabled global group was created
272	Security	4750	A security-disabled global group was changed
273	Security	4751	A member was added to a security-disabled global group
274	Security	4752	A member was removed from a security-disabled global group
275	Security	4753	A security-disabled global group was deleted
276	Security	4754	A security-enabled universal group was created
277	Security	4755	A security-enabled universal group was changed
278	Security	4756	A member was added to a security-enabled universal group
279	Security	4757	A member was removed from a security-enabled universal group
280	Security	4758	A security-enabled universal group was deleted
281	Security	4759	A security-disabled universal group was created
282	Security	4760	A security-disabled universal group was changed
283	Security	4761	A member was added to a security-disabled universal group
284	Security	4762	A member was removed from a security-disabled universal group
285	Security	4763	A security-disabled universal group was deleted
286	Security	4764	A groups type was changed
287	Security	4765	SID History was added to an account
288	Security	4766	An attempt to add SID History to an account failed
289	Security	4767	A user account was unlocked
290	Security	4768	A Kerberos authentication ticket (TGT) was requested
291	Security	4769	A Kerberos service ticket was requested
292	Security	4770	A Kerberos service ticket was renewed
293	Security	4771	Kerberos pre-authentication failed
294	Security	4772	A Kerberos authentication ticket request failed
295	Security	4773	A Kerberos service ticket request failed
296	Security	4774	An account was mapped for logon
297	Security	4775	An account could not be mapped for logon
298	Security	4776	The domain controller attempted to validate the credentials for an account
299	Security	4777	The domain controller failed to validate the credentials for an account
300	Security	4778	A session was reconnected to a Window Station
301	Security	4779	A session was disconnected from a Window Station
302	Security	4780	The ACL was set on accounts which are members of administrators groups
303	Security	4781	The name of an account was changed
304	Security	4782	The password hash an account was accessed
305	Security	4783	A basic application group was created
306	Security	4784	A basic application group was changed
307	Security	4785	A member was added to a basic application group
308	Security	4786	A member was removed from a basic application group
309	Security	4787	A non-member was added to a basic application group
310	Security	4788	A non-member was removed from a basic application group..
311	Security	4789	A basic application group was deleted
312	Security	4790	An LDAP query group was created
313	Security	4791	A basic application group was changed
314	Security	4792	An LDAP query group was deleted
315	Security	4793	The Password Policy Checking API was called
316	Security	4794	An attempt was made to set the Directory Services Restore Mode administrator password
317	Security	4800	The workstation was locked
318	Security	4801	The workstation was unlocked
319	Security	4802	The screen saver was invoked
320	Security	4803	The screen saver was dismissed
321	Security	4816	RPC detected an integrity violation while decrypting an incoming message
322	Security	4817	Auditing settings on object were changed.
323	Security	4864	A namespace collision was detected
324	Security	4865	A trusted forest information entry was added
325	Security	4866	A trusted forest information entry was removed
326	Security	4867	A trusted forest information entry was modified
327	Security	4868	The certificate manager denied a pending certificate request
328	Security	4869	Certificate Services received a resubmitted certificate request
329	Security	4870	Certificate Services revoked a certificate
330	Security	4871	Certificate Services received a request to publish the certificate revocation list (CRL)
331	Security	4872	Certificate Services published the certificate revocation list (CRL)
332	Security	4873	A certificate request extension changed
333	Security	4874	One or more certificate request attributes changed.
334	Security	4875	Certificate Services received a request to shut down
335	Security	4876	Certificate Services backup started
336	Security	4877	Certificate Services backup completed
337	Security	4878	Certificate Services restore started
338	Security	4879	Certificate Services restore completed
339	Security	4880	Certificate Services started
340	Security	4881	Certificate Services stopped
341	Security	4882	The security permissions for Certificate Services changed
342	Security	4883	Certificate Services retrieved an archived key
343	Security	4884	Certificate Services imported a certificate into its database
344	Security	4885	The audit filter for Certificate Services changed
345	Security	4886	Certificate Services received a certificate request
346	Security	4887	Certificate Services approved a certificate request and issued a certificate
347	Security	4888	Certificate Services denied a certificate request
348	Security	4889	Certificate Services set the status of a certificate request to pending
349	Security	4890	The certificate manager settings for Certificate Services changed.
350	Security	4891	A configuration entry changed in Certificate Services
351	Security	4892	A property of Certificate Services changed
352	Security	4893	Certificate Services archived a key
353	Security	4894	Certificate Services imported and archived a key
354	Security	4895	Certificate Services published the CA certificate to Active Directory Domain Services
355	Security	4896	One or more rows have been deleted from the certificate database
356	Security	4897	Role separation enabled
357	Security	4898	Certificate Services loaded a template
358	Security	4899	A Certificate Services template was updated
359	Security	4900	Certificate Services template security was updated
360	Security	4902	The Per-user audit policy table was created
361	Security	4904	An attempt was made to register a security event source
362	Security	4905	An attempt was made to unregister a security event source
363	Security	4906	The CrashOnAuditFail value has changed
364	Security	4907	Auditing settings on object were changed
365	Security	4908	Special Groups Logon table modified
366	Security	4909	The local policy settings for the TBS were changed
367	Security	4910	The group policy settings for the TBS were changed
368	Security	4912	Per User Audit Policy was changed
369	Security	4928	An Active Directory replica source naming context was established
370	Security	4929	An Active Directory replica source naming context was removed
371	Security	4930	An Active Directory replica source naming context was modified
372	Security	4931	An Active Directory replica destination naming context was modified
373	Security	4932	Synchronization of a replica of an Active Directory naming context has begun
374	Security	4933	Synchronization of a replica of an Active Directory naming context has ended
375	Security	4934	Attributes of an Active Directory object were replicated
376	Security	4935	Replication failure begins
377	Security	4936	Replication failure ends
378	Security	4937	A lingering object was removed from a replica
379	Security	4944	The following policy was active when the Windows Firewall started
380	Security	4945	A rule was listed when the Windows Firewall started
381	Security	4946	A change has been made to Windows Firewall exception list. A rule was added
382	Security	4947	A change has been made to Windows Firewall exception list. A rule was modified
383	Security	4948	A change has been made to Windows Firewall exception list. A rule was deleted
384	Security	4949	Windows Firewall settings were restored to the default values
385	Security	4950	A Windows Firewall setting has changed
386	Security	4951	A rule has been ignored because its major version number was not recognized by Windows Firewall
387	Security	4952	Parts of a rule have been ignored because its minor version number was not recognized by Windows Firewall
388	Security	4953	A rule has been ignored by Windows Firewall because it could not parse the rule
389	Security	4954	Windows Firewall Group Policy settings has changed. The new settings have been applied
390	Security	4956	Windows Firewall has changed the active profile
391	Security	4957	Windows Firewall did not apply the following rule
392	Security	4958	Windows Firewall did not apply the following rule because the rule referred to items not configured on this computer
393	Security	4960	IPsec dropped an inbound packet that failed an integrity check
394	Security	4961	IPsec dropped an inbound packet that failed a replay check
395	Security	4962	IPsec dropped an inbound packet that failed a replay check
396	Security	4963	IPsec dropped an inbound clear text packet that should have been secured
397	Security	4964	Special groups have been assigned to a new logon
398	Security	4965	IPsec received a packet from a remote computer with an incorrect Security Parameter Index (SPI).
399	Security	4976	During Main Mode negotiation, IPsec received an invalid negotiation packet.
400	Security	4977	During Quick Mode negotiation, IPsec received an invalid negotiation packet.
401	Security	4978	During Extended Mode negotiation, IPsec received an invalid negotiation packet.
402	Security	4979	IPsec Main Mode and Extended Mode security associations were established.
403	Security	4980	IPsec Main Mode and Extended Mode security associations were established
404	Security	4981	IPsec Main Mode and Extended Mode security associations were established
405	Security	4982	IPsec Main Mode and Extended Mode security associations were established
406	Security	4983	An IPsec Extended Mode negotiation failed
407	Security	4984	An IPsec Extended Mode negotiation failed
408	Security	4985	The state of a transaction has changed
409	Security	5024	The Windows Firewall Service has started successfully
410	Security	5025	The Windows Firewall Service has been stopped
411	Security	5027	The Windows Firewall Service was unable to retrieve the security policy from the local storage
412	Security	5028	The Windows Firewall Service was unable to parse the new security policy.
413	Security	5029	The Windows Firewall Service failed to initialize the driver
414	Security	5030	The Windows Firewall Service failed to start
415	Security	5031	The Windows Firewall Service blocked an application from accepting incoming connections on the network.
416	Security	5032	Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network
417	Security	5033	The Windows Firewall Driver has started successfully
418	Security	5034	The Windows Firewall Driver has been stopped
419	Security	5035	The Windows Firewall Driver failed to start
420	Security	5037	The Windows Firewall Driver detected critical runtime error. Terminating
421	Security	5038	Code integrity determined that the image hash of a file is not valid
422	Security	5039	A registry key was virtualized.
423	Security	5040	A change has been made to IPsec settings. An Authentication Set was added.
424	Security	5041	A change has been made to IPsec settings. An Authentication Set was modified
425	Security	5042	A change has been made to IPsec settings. An Authentication Set was deleted
426	Security	5043	A change has been made to IPsec settings. A Connection Security Rule was added
427	Security	5044	A change has been made to IPsec settings. A Connection Security Rule was modified
428	Security	5045	A change has been made to IPsec settings. A Connection Security Rule was deleted
429	Security	5046	A change has been made to IPsec settings. A Crypto Set was added
430	Security	5047	A change has been made to IPsec settings. A Crypto Set was modified
431	Security	5048	A change has been made to IPsec settings. A Crypto Set was deleted
432	Security	5049	An IPsec Security Association was deleted
433	Security	5050	An attempt to programmatically disable the Windows Firewall using a call to INetFwProfile.FirewallEnabled(FALSE
434	Security	5051	A file was virtualized
435	Security	5056	A cryptographic self test was performed
436	Security	5057	A cryptographic primitive operation failed
437	Security	5058	Key file operation
438	Security	5059	Key migration operation
439	Security	5060	Verification operation failed
440	Security	5061	Cryptographic operation
441	Security	5062	A kernel-mode cryptographic self test was performed
442	Security	5063	A cryptographic provider operation was attempted
443	Security	5064	A cryptographic context operation was attempted
444	Security	5065	A cryptographic context modification was attempted
445	Security	5066	A cryptographic function operation was attempted
446	Security	5067	A cryptographic function modification was attempted
447	Security	5068	A cryptographic function provider operation was attempted
448	Security	5069	A cryptographic function property operation was attempted
449	Security	5070	A cryptographic function property operation was attempted
450	Security	5120	OCSP Responder Service Started
451	Security	5121	OCSP Responder Service Stopped
452	Security	5122	A Configuration entry changed in the OCSP Responder Service
453	Security	5123	A configuration entry changed in the OCSP Responder Service
454	Security	5124	A security setting was updated on OCSP Responder Service
455	Security	5125	A request was submitted to OCSP Responder Service
456	Security	5126	Signing Certificate was automatically updated by the OCSP Responder Service
457	Security	5127	The OCSP Revocation Provider successfully updated the revocation information
458	Security	5136	A directory service object was modified
459	Security	5137	A directory service object was created
460	Security	5138	A directory service object was undeleted
461	Security	5139	A directory service object was moved
462	Security	5140	A network share object was accessed
463	Security	5141	A directory service object was deleted
464	Security	5142	A network share object was added.
465	Security	5143	A network share object was modified
466	Security	5144	A network share object was deleted.
467	Security	5145	A network share object was checked to see whether client can be granted desired access
468	Security	5148	The Windows Filtering Platform has detected a DoS attack and entered a defensive mode; packets associated with this attack will be discarded.
469	Security	5149	The DoS attack has subsided and normal processing is being resumed.
470	Security	5150	The Windows Filtering Platform has blocked a packet.
471	Security	5151	A more restrictive Windows Filtering Platform filter has blocked a packet.
472	Security	5152	The Windows Filtering Platform blocked a packet
473	Security	5153	A more restrictive Windows Filtering Platform filter has blocked a packet
474	Security	5154	The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections
475	Security	5155	The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections
476	Security	5156	The Windows Filtering Platform has allowed a connection
477	Security	5157	The Windows Filtering Platform has blocked a connection
478	Security	5158	The Windows Filtering Platform has permitted a bind to a local port
479	Security	5159	The Windows Filtering Platform has blocked a bind to a local port
480	Security	5168	Spn check for SMB/SMB2 fails.
481	Security	5376	Credential Manager credentials were backed up
482	Security	5377	Credential Manager credentials were restored from a backup
483	Security	5378	The requested credentials delegation was disallowed by policy
484	Security	5440	The following callout was present when the Windows Filtering Platform Base Filtering Engine started
485	Security	5441	The following filter was present when the Windows Filtering Platform Base Filtering Engine started
486	Security	5442	The following provider was present when the Windows Filtering Platform Base Filtering Engine started
487	Security	5443	The following provider context was present when the Windows Filtering Platform Base Filtering Engine started
488	Security	5444	The following sub-layer was present when the Windows Filtering Platform Base Filtering Engine started
489	Security	5446	A Windows Filtering Platform callout has been changed
490	Security	5447	A Windows Filtering Platform filter has been changed
491	Security	5448	A Windows Filtering Platform provider has been changed
492	Security	5449	A Windows Filtering Platform provider context has been changed
493	Security	5450	A Windows Filtering Platform sub-layer has been changed
494	Security	5451	An IPsec Quick Mode security association was established
495	Security	5452	An IPsec Quick Mode security association ended
496	Security	5453	An IPsec negotiation with a remote computer failed because the IKE and AuthIP IPsec Keying Modules (IKEEXT) service is not started
497	Security	5456	PAStore Engine applied Active Directory storage IPsec policy on the computer
498	Security	5457	PAStore Engine failed to apply Active Directory storage IPsec policy on the computer
499	Security	5458	PAStore Engine applied locally cached copy of Active Directory storage IPsec policy on the computer
500	Security	5459	PAStore Engine failed to apply locally cached copy of Active Directory storage IPsec policy on the computer
501	Security	5460	PAStore Engine applied local registry storage IPsec policy on the computer
502	Security	5461	PAStore Engine failed to apply local registry storage IPsec policy on the computer
503	Security	5462	PAStore Engine failed to apply some rules of the active IPsec policy on the computer
504	Security	5463	PAStore Engine polled for changes to the active IPsec policy and detected no changes
505	Security	5464	PAStore Engine polled for changes to the active IPsec policy, detected changes, and applied them to IPsec Services
506	Security	5465	PAStore Engine received a control for forced reloading of IPsec policy and processed the control successfully
507	Security	5466	PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory cannot be reached, and will use the cached copy of the Active Directory IPsec policy instead
508	Security	5467	PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, and found no changes to the policy
509	Security	5468	PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, found changes to the policy, and applied those changes
510	Security	5471	PAStore Engine loaded local storage IPsec policy on the computer
511	Security	5472	PAStore Engine failed to load local storage IPsec policy on the computer
512	Security	5473	PAStore Engine loaded directory storage IPsec policy on the computer
513	Security	5474	PAStore Engine failed to load directory storage IPsec policy on the computer
514	Security	5477	PAStore Engine failed to add quick mode filter
515	Security	5478	IPsec Services has started successfully
516	Security	5479	IPsec Services has been shut down successfully
517	Security	5480	IPsec Services failed to get the complete list of network interfaces on the computer
518	Security	5483	IPsec Services failed to initialize RPC server. IPsec Services could not be started
519	Security	5484	IPsec Services has experienced a critical failure and has been shut down
520	Security	5485	IPsec Services failed to process some IPsec filters on a plug-and-play event for network interfaces
521	Security	5632	A request was made to authenticate to a wireless network
522	Security	5633	A request was made to authenticate to a wired network
523	Security	5712	A Remote Procedure Call (RPC) was attempted
524	Security	5888	An object in the COM+ Catalog was modified
525	Security	5889	An object was deleted from the COM+ Catalog
526	Security	5890	An object was added to the COM+ Catalog
527	Security	6144	Security policy in the group policy objects has been applied successfully
528	Security	6145	One or more errors occured while processing security policy in the group policy objects
529	Security	6272	Network Policy Server granted access to a user
530	Security	6273	Network Policy Server denied access to a user
531	Security	6274	Network Policy Server discarded the request for a user
532	Security	6275	Network Policy Server discarded the accounting request for a user
533	Security	6276	Network Policy Server quarantined a user
534	Security	6277	Network Policy Server granted access to a user but put it on probation because the host did not meet the defined health policy
535	Security	6278	Network Policy Server granted full access to a user because the host met the defined health policy
536	Security	6279	Network Policy Server locked the user account due to repeated failed authentication attempts
537	Security	6280	Network Policy Server unlocked the user account
538	Security	6281	Code Integrity determined that the page hashes of an image file are not valid...
539	Security	6400	BranchCache: Received an incorrectly formatted response while discovering availability of content.
540	Security	6401	BranchCache: Received invalid data from a peer. Data discarded.
541	Security	6402	BranchCache: The message to the hosted cache offering it data is incorrectly formatted.
542	Security	6403	BranchCache: The hosted cache sent an incorrectly formatted response to the client's message to offer it data.
543	Security	6404	BranchCache: Hosted cache could not be authenticated using the provisioned SSL certificate.
544	Security	6405	BranchCache: %2 instance(s) of event id %1 occurred.
545	Security	6406	%1 registered to Windows Firewall to control filtering for the following:
546	Security	6407	%1
547	Security	6408	Registered product %1 failed and Windows Firewall is now controlling the filtering for %2.