SH-Deployer/apps/Splunk_TA_windows/lookups/xmlsecurity_eventcode_action_multiinput.csv

1	EventCode	action	Error_Code	Description
2	4625	failure	0XC000005E	There are currently no logon servers available to service the logon request.
3	4625	unknown	0xC0000064	User logon with misspelled or bad user account
4	4625	failure	0xC000006A	User logon with misspelled or bad password
5	4625	failure	0XC000006D	This is either due to a bad username or authentication information
6	4625	failure	0XC000006E	Unknown user name or bad password.
7	4625	failure	0XC000010B	Indicates an invalid value has been provided for the LogonType requested.
8	4625	denied	0xC000006F	User logon outside authorized hours
9	4625	denied	0xC0000070	User logon from unauthorized workstation
10	4625	failure	0xC0000071	User logon with expired password
11	4625	failure	0xC0000072	User logon to account disabled by administrator
12	4625	failure	0XC00000DC	Indicates the Sam Server was in the wrong state to perform the desired operation.
13	4625	error	0XC0000133	Clocks between DC and other computer too far out of sync
14	4625	denied	0XC000015B	The user has not been granted the requested logon type (aka logon right) at this machine
15	4625	failure	0XC000018C	The logon request failed because the trust relationship between the primary domain and the trusted domain failed.
16	4625	failure	0XC0000192	An attempt was made to logon, but the Netlogon service was not started.
17	4625	failure	0xC0000193	User logon with expired account
18	4625	failure	0XC0000224	User is required to change password at next logon
19	4625	error	0XC0000225	Evidently a bug in Windows and not a risk
20	4625	denied	0xC0000234	User logon with account locked
21	4625	failure	0XC00002EE	Failure Reason: An Error occurred during Logon
22	4625	failure	0XC0000413	Logon Failure: The machine you are logging onto is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine.
23	4625	failure	0x0	Status OK.
24	4776	failure	0xC0000064	The username you typed does not exist. Bad username.
25	4776	failure	0xC000006A	Account logon with misspelled or bad password.
26	4776	failure	0xC000006D	Generic logon failure.
27	4776	denied	0xC000006F	Account logon outside authorized hours.
28	4776	denied	0xC0000070	Account logon from unauthorized workstation.
29	4776	failure	0xC0000071	Account logon with expired password.
30	4776	failure	0xC0000072	Account logon to account disabled by administrator.
31	4776	failure	0xC0000193	Account logon with expired account.
32	4776	failure	0xC0000234	Account logon with account locked.
33	4776	failure	0xc0000371	The local account store does not contain secret material for the specified account.
34	4776	success	0x0	No errors.
35	4768	success	0x0	No error
36	4768	failure	0x1	Client's entry in KDC database has expired
37	4768	failure	0x2	Server's entry in KDC database has expired
38	4768	failure	0x3	Requested Kerberos version number not supported
39	4768	failure	0x4	Client's key encrypted in old master key
40	4768	failure	0x5	Server's key encrypted in old master key
41	4768	failure	0x6	Client not found in Kerberos database
42	4768	failure	0x7	Server not found in Kerberos database
43	4768	failure	0x8	Multiple principal entries in KDC database
44	4768	failure	0x9	The client or server has a null key (master key)
45	4768	failure	0xA	Ticket (TGT) not eligible for postdating
46	4768	failure	0xB	Requested start time is later than end time
47	4768	failure	0xC	Requested start time is later than end time
48	4768	failure	0xD	KDC cannot accommodate requested option
49	4768	failure	0xE	KDC has no support for encryption type
50	4768	failure	0xF	KDC has no support for checksum type
51	4768	failure	0x10	KDC has no support for PADATA type (pre-authentication data)
52	4768	failure	0x11	KDC has no support for transited type
53	4768	failure	0x12	Client's credentials have been revoked
54	4768	failure	0x13	Credentials for server have been revoked
55	4768	failure	0x14	TGT has been revoked
56	4768	failure	0x15	Client not yet valid-try again later
57	4768	failure	0x16	Server not yet valid-try again later
58	4768	failure	0x17	Password has expired-change password to reset
59	4768	failure	0x18	Pre-authentication information was invalid
60	4768	failure	0x19	Additional pre-authentication required
61	4768	failure	0x1A	KDC does not know about the requested server
62	4768	failure	0x1B	KDC is unavailable
63	4768	failure	0x1F	Integrity check on decrypted field failed
64	4768	failure	0x20	The ticket has expired
65	4768	failure	0x21	The ticket is not yet valid
66	4768	failure	0x22	The request is a replay
67	4768	failure	0x23	The ticket is not for us
68	4768	failure	0x24	The ticket and authenticator do not match
69	4768	failure	0x25	The clock skew is too great
70	4768	failure	0x26	Network address in network layer header doesn't match address inside ticket
71	4768	failure	0x27	Protocol version numbers don't match (PVNO)
72	4768	failure	0x28	Message type is unsupported
73	4768	failure	0x29	Message stream modified and checksum didn't match
74	4768	failure	0x2A	Message out of order (possible tampering)
75	4768	failure	0x2C	Specified version of key is not available
76	4768	failure	0x2D	Service key not available
77	4768	failure	0x2E	Mutual authentication failed
78	4768	failure	0x2F	Incorrect message direction
79	4768	failure	0x30	Alternative authentication method required
80	4768	failure	0x31	Incorrect sequence number in message
81	4768	failure	0x32	Inappropriate type of checksum in message (checksum may be unsupported)
82	4768	failure	0x33	Desired path is unreachable
83	4768	failure	0x34	Too much data
84	4768	failure	0x3C	Generic error
85	4768	failure	0x3D	Field is too long for this implementation
86	4768	failure	0x3E	The client trust failed or is not implemented
87	4768	failure	0x3F	The KDC server trust failed or could not be verified
88	4768	failure	0x40	The signature is invalid
89	4768	failure	0x41	A higher encryption level is needed
90	4768	failure	0x42	User-to-user authorization is required
91	4768	failure	0x43	No TGT was presented or available
92	4768	failure	0x44	Incorrect domain or principal
93	4769	success	0x0	No error
94	4769	failure	0x1	Client's entry in KDC database has expired
95	4769	failure	0x2	Server's entry in KDC database has expired
96	4769	failure	0x3	Requested Kerberos version number not supported
97	4769	failure	0x4	Client's key encrypted in old master key
98	4769	failure	0x5	Server's key encrypted in old master key
99	4769	failure	0x6	Client not found in Kerberos database
100	4769	failure	0x7	Server not found in Kerberos database
101	4769	failure	0x8	Multiple principal entries in KDC database
102	4769	failure	0x9	The client or server has a null key (master key)
103	4769	failure	0xA	Ticket (TGT) not eligible for postdating
104	4769	failure	0xB	Requested start time is later than end time
105	4769	failure	0xC	Requested start time is later than end time
106	4769	failure	0xD	KDC cannot accommodate requested option
107	4769	failure	0xE	KDC has no support for encryption type
108	4769	failure	0xF	KDC has no support for checksum type
109	4769	failure	0x10	KDC has no support for PADATA type (pre-authentication data)
110	4769	failure	0x11	KDC has no support for transited type
111	4769	failure	0x12	Client's credentials have been revoked
112	4769	failure	0x13	Credentials for server have been revoked
113	4769	failure	0x14	TGT has been revoked
114	4769	failure	0x15	Client not yet valid try again later
115	4769	failure	0x16	Server not yet valid try again later
116	4769	failure	0x17	Password has expired change password to reset
117	4769	failure	0x18	Pre-authentication information was invalid
118	4769	failure	0x19	Additional pre-authentication required
119	4769	failure	0x1A	KDC does not know about the requested server
120	4769	failure	0x1B	KDC is unavailable
121	4769	failure	0x1F	Integrity check on decrypted field failed
122	4769	failure	0x20	The ticket has expired
123	4769	failure	0x21	The ticket is not yet valid
124	4769	failure	0x22	The request is a replay
125	4769	failure	0x23	The ticket is not for us
126	4769	failure	0x24	The ticket and authenticator do not match
127	4769	failure	0x25	The clock skew is too great
128	4769	failure	0x26	Network address in network layer header doesn't match address inside ticket
129	4769	failure	0x27	Protocol version numbers don't match (PVNO)
130	4769	failure	0x28	Message type is unsupported
131	4769	failure	0x29	Message stream modified and checksum didn't match
132	4769	failure	0x2A	Message out of order (possible tampering)
133	4769	failure	0x2C	Specified version of key is not available
134	4769	failure	0x2D	Service key not available
135	4769	failure	0x2E	Mutual authentication failed
136	4769	failure	0x2F	Incorrect message direction
137	4769	failure	0x30	Alternative authentication method required
138	4769	failure	0x31	Incorrect sequence number in message
139	4769	failure	0x32	Inappropriate type of checksum in message (checksum may be unsupported)
140	4769	failure	0x33	Desired path is unreachable
141	4769	failure	0x34	Too much data
142	4769	failure	0x3C	Generic error
143	4769	failure	0x3D	Field is too long for this implementation
144	4769	failure	0x3E	The client trust failed or is not implemented
145	4769	failure	0x3F	The KDC server trust failed or could not be verified
146	4769	failure	0x40	The signature is invalid
147	4769	failure	0x41	A higher encryption level is needed
148	4769	failure	0x42	User-to-user authorization is required
149	4769	failure	0x43	No TGT was presented or available
150	4769	failure	0x44	Incorrect domain or principal
151	4771	failure	0x1	Client's entry in database has expired
152	4771	failure	0x2	Server's entry in database has expired
153	4771	failure	0x3	Requested protocol version # not supported
154	4771	failure	0x4	Client's key encrypted in old master key
155	4771	failure	0x5	Server's key encrypted in old master key
156	4771	failure	0x6	Client not found in Kerberos database
157	4771	failure	0x7	Server not found in Kerberos database
158	4771	failure	0x8	Multiple principal entries in database
159	4771	failure	0x9	The client or server has a null key
160	4771	failure	0xA	Ticket not eligible for postdating
161	4771	failure	0xB	Requested start time is later than end time
162	4771	failure	0xC	KDC policy rejects request
163	4771	failure	0xD	KDC cannot accommodate requested option
164	4771	failure	0xE	KDC has no support for encryption type
165	4771	failure	0xF	KDC has no support for checksum type
166	4771	failure	0x10	KDC has no support for padata type
167	4771	failure	0x11	KDC has no support for transited type
168	4771	failure	0x12	Clients credentials have been revoked
169	4771	failure	0x13	Credentials for server have been revoked
170	4771	failure	0x14	TGT has been revoked
171	4771	failure	0x15	Client not yet valid - try again later
172	4771	failure	0x16	Server not yet valid - try again later
173	4771	failure	0x17	Password has expired
174	4771	failure	0x18	Pre-authentication information was invalid
175	4771	failure	0x19	Additional pre-authentication required*
176	4771	failure	0x1F	Integrity check on decrypted field failed
177	4771	failure	0x20	Ticket expired
178	4771	failure	0x21	Ticket not yet valid
179	4771	failure	0x22	Request is a replay
180	4771	failure	0x23	The ticket isn't for us
181	4771	failure	0x24	Ticket and authenticator don't match
182	4771	failure	0x25	Clock skew too great
183	4771	failure	0x26	Incorrect net address
184	4771	failure	0x27	Protocol version mismatch
185	4771	failure	0x28	Invalid msg type
186	4771	failure	0x29	Message stream modified
187	4771	failure	0x2A	Message out of order
188	4771	failure	0x2C	Specified version of key is not available
189	4771	failure	0x2D	Service key not available
190	4771	failure	0x2E	Mutual authentication failed
191	4771	failure	0x2F	Incorrect message direction
192	4771	failure	0x30	Alternative authentication method required*
193	4771	failure	0x31	Incorrect sequence number in message
194	4771	failure	0x32	Inappropriate type of checksum in message
195	4771	failure	0x3C	Generic error
196	4771	failure	0x3D	Field is too long for this implementation