Skip to main content

Windows Event Viewer Notes

Last Updated: September 19, 2016

Logon Types

Type 2Interactive (console login)
Type 3Network
Type 4Batch (scheduled tasks)
Type 5Services
Type 7Unlock
Type 8Network (cleartext)
Type 9NewCredentials (RunAs)
Type 10RemoteInteractive (RDP connections)
Type 11CachedInteractive (not connected to domain)

Logon failure events

0xC0000064User name does not exist
0xC000006AUser name is correct but the password is wrong
0xC0000234User is currently locked out
0xC0000072Account is currently disabled
0xC000006FUser tried to logon outside his day of week or time of day restrictions
0xC0000070Workstation restriction
0xC00000193Account expiration
0xC0000071Expired password
0xC0000133Clocks between DC and other computer too far out of sync
0xC0000224User is required to change password at next logon
0xC0000225Evidently a bug in Windows and not a risk
0xC000015b"The user has not been granted the requested logon"

Logon sessions

4647user initiated logon
4800Workstation Locked
4801Workstation unlocked
4802Screen saver loaded
4803Screen saver dismissed
4778RDP reconnected
4779RDP disconnected

User account changes

4720Created
4722Enabled
4723User changed own password
4724Privileged User changed this user’s password
4725Disabled
4726Deleted
4738Changed
4740Locked out
4767Unlocked
4781Name change
Logon TypeExplanation
2Logon via console
3Network Logon, A user or computer logged on to this computer from the network.
4Batch logon
5Windows Service Logon
7Credentials used to unlock screen
8Network logon sending credentials (cleartext)
9Different credentials used than logged on user
10Remote interactive logon (RDP)
11Cached credentials used to logon
12Cached remote interactive
13Cached unlock (Similar to logon type 7)
Event IDDescriptionLog Name
4624Successful LogonSecurity
4625Failed LoginSecurity
4776Successful /Failed Account AuthenticationSecurity
4720A user account was createdSecurity
4732A member was added to a security-enabled local groupSecurity
4728A member was added to a security-enabled global groupSecurity
7030Service Creation ErrorsSystem
7045Service CreationSystem