Recherche d’ID d’événement Windows
Consultez les ID d’événement Windows courants : sessions, comptes, services, Kerberos, RDP et PowerShell. Utile pour le dépannage et les audits.
S’exécute dans votre navigateur · rien n’est envoyéJournaux & configuration Windows
81 résultats
| ID d’événement | Journal | Description |
|---|---|---|
| 4624 | Security | An account was successfully logged on. |
| 4625 | Security | An account failed to log on. Many in a row can indicate brute-forcing. |
| 4634 | Security | An account was logged off. |
| 4647 | Security | User initiated logoff. |
| 4648 | Security | A logon was attempted using explicit credentials (runas, RDP). |
| 4672 | Security | Special privileges assigned to a new logon (administrator-level). |
| 4720 | Security | A user account was created. |
| 4722 | Security | A user account was enabled. |
| 4723 | Security | An attempt was made to change an account password. |
| 4724 | Security | An attempt was made to reset an account password. |
| 4725 | Security | A user account was disabled. |
| 4726 | Security | A user account was deleted. |
| 4728 | Security | A member was added to a security-enabled global group. |
| 4732 | Security | A member was added to a security-enabled local group (for example Administrators). |
| 4738 | Security | A user account was changed. |
| 4740 | Security | A user account was locked out. |
| 4756 | Security | A member was added to a security-enabled universal group. |
| 4767 | Security | A user account was unlocked. |
| 4768 | Security | A Kerberos authentication ticket (TGT) was requested. |
| 4769 | Security | A Kerberos service ticket was requested. |
| 4771 | Security | Kerberos pre-authentication failed. |
| 4776 | Security | The computer attempted to validate credentials (NTLM). |
| 4656 | Security | A handle to an object was requested. |
| 4663 | Security | An attempt was made to access an object (file auditing). |
| 4698 | Security | A scheduled task was created. |
| 4699 | Security | A scheduled task was deleted. |
| 4700 | Security | A scheduled task was enabled. |
| 4702 | Security | A scheduled task was updated. |
| 4688 | Security | A new process was created (needs process auditing). |
| 4689 | Security | A process has exited. |
| 4697 | Security | A service was installed on the system. |
| 4719 | Security | System audit policy was changed. |
| 4739 | Security | Domain policy was changed. |
| 1102 | Security | The audit log was cleared. Often a sign of tampering. |
| 4616 | Security | The system time was changed. |
| 5140 | Security | A network share object was accessed. |
| 5142 | Security | A network share object was added. |
| 5145 | Security | A network share object was checked for access. |
| 5156 | Security | The Windows Filtering Platform allowed a connection. |
| 5157 | Security | The Windows Filtering Platform blocked a connection. |
| 6005 | System | The Event Log service was started (system startup). |
| 6006 | System | The Event Log service was stopped (clean shutdown). |
| 6008 | System | The previous system shutdown was unexpected. |
| 6013 | System | System uptime report. |
| 41 | System | Kernel-Power: the system rebooted without cleanly shutting down. |
| 1074 | System | A process initiated a restart or shutdown. |
| 1076 | System | The reason for an unexpected shutdown was recorded by a user. |
| 7000 | System | A service failed to start. |
| 7001 | System | A service depends on another service that failed to start. |
| 7009 | System | A service timeout occurred while waiting for it to connect. |
| 7023 | System | A service terminated with an error. |
| 7031 | System | A service terminated unexpectedly. |
| 7034 | System | A service terminated unexpectedly (crash). |
| 7036 | System | A service entered the running or stopped state. |
| 7040 | System | The start type of a service was changed. |
| 7045 | System | A new service was installed in the system. |
| 55 | System | NTFS: the file system structure on the disk is corrupt. |
| 98 | System | NTFS: the volume was checked and is healthy. |
| 129 | System | A disk controller did not respond (storport reset). |
| 153 | System | The IO operation was retried (disk). |
| 2004 | System | Resource exhaustion: low virtual memory. |
| 1000 | Application | Application error (crash). |
| 1001 | Application | Windows Error Reporting for an application fault. |
| 1002 | Application | Application hang. |
| 11707 | Application | Windows Installer: product installed successfully. |
| 11724 | Application | Windows Installer: product removed successfully. |
| 4104 | PowerShell | PowerShell script block logging. |
| 4103 | PowerShell | PowerShell module logging. |
| 400 | PowerShell | PowerShell engine state changed to Available (start). |
| 4202 | DNS | DNS server could not open a socket. |
| 1644 | Directory Service | Expensive or inefficient LDAP search. |
| 2889 | Directory Service | A client made an unsigned LDAP bind. |
| 5136 | Security | A directory service object was modified. |
| 5137 | Security | A directory service object was created. |
| 5141 | Security | A directory service object was deleted. |
| 20 | WindowsUpdateClient | Windows Update: installation failure. |
| 19 | WindowsUpdateClient | Windows Update: installation successful. |
| 21 | TerminalServices | Remote Desktop session logon succeeded. |
| 23 | TerminalServices | Remote Desktop session logoff succeeded. |
| 24 | TerminalServices | Remote Desktop session disconnected. |
| 25 | TerminalServices | Remote Desktop session reconnection succeeded. |
Les descriptions de cette référence sont pour l’instant en anglais.
Explication
Recherchez par ID d’événement ou mot-clé. La liste couvre des événements fréquents des journaux Sécurité, Système et Application.
🔒 Votre saisie reste dans votre navigateur et n’est envoyée nulle part.
Questions fréquentes
Quel événement indique un échec de connexion ?
L’événement 4625 du journal de sécurité. Beaucoup en peu de temps peuvent indiquer des essais de mots de passe.
Et ensuite ?
Un problème ou une suggestion ? Dites-le-nous