Buscador de ID de eventos de Windows
Consulta ID de eventos habituales de Windows: sesiones, cuentas, servicios, Kerberos, RDP y PowerShell. Útil para diagnóstico y auditorías.
Se ejecuta en tu navegador · no se envía nadaLogs y configuración de Windows
81 resultados
| ID de evento | Registro | Descripción |
|---|---|---|
| 4624 | Security | An account was successfully logged on. |
| 4625 | Security | An account failed to log on. Many in a row can indicate brute-forcing. |
| 4634 | Security | An account was logged off. |
| 4647 | Security | User initiated logoff. |
| 4648 | Security | A logon was attempted using explicit credentials (runas, RDP). |
| 4672 | Security | Special privileges assigned to a new logon (administrator-level). |
| 4720 | Security | A user account was created. |
| 4722 | Security | A user account was enabled. |
| 4723 | Security | An attempt was made to change an account password. |
| 4724 | Security | An attempt was made to reset an account password. |
| 4725 | Security | A user account was disabled. |
| 4726 | Security | A user account was deleted. |
| 4728 | Security | A member was added to a security-enabled global group. |
| 4732 | Security | A member was added to a security-enabled local group (for example Administrators). |
| 4738 | Security | A user account was changed. |
| 4740 | Security | A user account was locked out. |
| 4756 | Security | A member was added to a security-enabled universal group. |
| 4767 | Security | A user account was unlocked. |
| 4768 | Security | A Kerberos authentication ticket (TGT) was requested. |
| 4769 | Security | A Kerberos service ticket was requested. |
| 4771 | Security | Kerberos pre-authentication failed. |
| 4776 | Security | The computer attempted to validate credentials (NTLM). |
| 4656 | Security | A handle to an object was requested. |
| 4663 | Security | An attempt was made to access an object (file auditing). |
| 4698 | Security | A scheduled task was created. |
| 4699 | Security | A scheduled task was deleted. |
| 4700 | Security | A scheduled task was enabled. |
| 4702 | Security | A scheduled task was updated. |
| 4688 | Security | A new process was created (needs process auditing). |
| 4689 | Security | A process has exited. |
| 4697 | Security | A service was installed on the system. |
| 4719 | Security | System audit policy was changed. |
| 4739 | Security | Domain policy was changed. |
| 1102 | Security | The audit log was cleared. Often a sign of tampering. |
| 4616 | Security | The system time was changed. |
| 5140 | Security | A network share object was accessed. |
| 5142 | Security | A network share object was added. |
| 5145 | Security | A network share object was checked for access. |
| 5156 | Security | The Windows Filtering Platform allowed a connection. |
| 5157 | Security | The Windows Filtering Platform blocked a connection. |
| 6005 | System | The Event Log service was started (system startup). |
| 6006 | System | The Event Log service was stopped (clean shutdown). |
| 6008 | System | The previous system shutdown was unexpected. |
| 6013 | System | System uptime report. |
| 41 | System | Kernel-Power: the system rebooted without cleanly shutting down. |
| 1074 | System | A process initiated a restart or shutdown. |
| 1076 | System | The reason for an unexpected shutdown was recorded by a user. |
| 7000 | System | A service failed to start. |
| 7001 | System | A service depends on another service that failed to start. |
| 7009 | System | A service timeout occurred while waiting for it to connect. |
| 7023 | System | A service terminated with an error. |
| 7031 | System | A service terminated unexpectedly. |
| 7034 | System | A service terminated unexpectedly (crash). |
| 7036 | System | A service entered the running or stopped state. |
| 7040 | System | The start type of a service was changed. |
| 7045 | System | A new service was installed in the system. |
| 55 | System | NTFS: the file system structure on the disk is corrupt. |
| 98 | System | NTFS: the volume was checked and is healthy. |
| 129 | System | A disk controller did not respond (storport reset). |
| 153 | System | The IO operation was retried (disk). |
| 2004 | System | Resource exhaustion: low virtual memory. |
| 1000 | Application | Application error (crash). |
| 1001 | Application | Windows Error Reporting for an application fault. |
| 1002 | Application | Application hang. |
| 11707 | Application | Windows Installer: product installed successfully. |
| 11724 | Application | Windows Installer: product removed successfully. |
| 4104 | PowerShell | PowerShell script block logging. |
| 4103 | PowerShell | PowerShell module logging. |
| 400 | PowerShell | PowerShell engine state changed to Available (start). |
| 4202 | DNS | DNS server could not open a socket. |
| 1644 | Directory Service | Expensive or inefficient LDAP search. |
| 2889 | Directory Service | A client made an unsigned LDAP bind. |
| 5136 | Security | A directory service object was modified. |
| 5137 | Security | A directory service object was created. |
| 5141 | Security | A directory service object was deleted. |
| 20 | WindowsUpdateClient | Windows Update: installation failure. |
| 19 | WindowsUpdateClient | Windows Update: installation successful. |
| 21 | TerminalServices | Remote Desktop session logon succeeded. |
| 23 | TerminalServices | Remote Desktop session logoff succeeded. |
| 24 | TerminalServices | Remote Desktop session disconnected. |
| 25 | TerminalServices | Remote Desktop session reconnection succeeded. |
Las descripciones de esta referencia están por ahora en inglés.
Explicación
Busca por ID de evento o palabra clave. La lista incluye eventos frecuentes de los registros Seguridad, Sistema y Aplicación.
🔒 Tu entrada se queda en tu navegador y no se envía a ningún sitio.
Preguntas frecuentes
¿Qué evento muestra un inicio de sesión fallido?
El evento 4625 del registro de seguridad. Muchos en poco tiempo pueden indicar intentos de adivinar contraseñas.
Qué hacer después
¿Has encontrado un problema o tienes una sugerencia? Cuéntanoslo