Windows Event-ID opzoeken

Zoek veelvoorkomende Windows Event-ID’s op: aanmelden, accountwijzigingen, services, Kerberos, RDP en PowerShell. Handig bij storingen en audits.

Draait in je browser · er wordt niets verstuurdWindows-logs & configuratie

Zoeken

81 resultaten

Event-ID	Logboek	Omschrijving
4624	Security	An account was successfully logged on.
4625	Security	An account failed to log on. Many in a row can indicate brute-forcing.
4634	Security	An account was logged off.
4647	Security	User initiated logoff.
4648	Security	A logon was attempted using explicit credentials (runas, RDP).
4672	Security	Special privileges assigned to a new logon (administrator-level).
4720	Security	A user account was created.
4722	Security	A user account was enabled.
4723	Security	An attempt was made to change an account password.
4724	Security	An attempt was made to reset an account password.
4725	Security	A user account was disabled.
4726	Security	A user account was deleted.
4728	Security	A member was added to a security-enabled global group.
4732	Security	A member was added to a security-enabled local group (for example Administrators).
4738	Security	A user account was changed.
4740	Security	A user account was locked out.
4756	Security	A member was added to a security-enabled universal group.
4767	Security	A user account was unlocked.
4768	Security	A Kerberos authentication ticket (TGT) was requested.
4769	Security	A Kerberos service ticket was requested.
4771	Security	Kerberos pre-authentication failed.
4776	Security	The computer attempted to validate credentials (NTLM).
4656	Security	A handle to an object was requested.
4663	Security	An attempt was made to access an object (file auditing).
4698	Security	A scheduled task was created.
4699	Security	A scheduled task was deleted.
4700	Security	A scheduled task was enabled.
4702	Security	A scheduled task was updated.
4688	Security	A new process was created (needs process auditing).
4689	Security	A process has exited.
4697	Security	A service was installed on the system.
4719	Security	System audit policy was changed.
4739	Security	Domain policy was changed.
1102	Security	The audit log was cleared. Often a sign of tampering.
4616	Security	The system time was changed.
5140	Security	A network share object was accessed.
5142	Security	A network share object was added.
5145	Security	A network share object was checked for access.
5156	Security	The Windows Filtering Platform allowed a connection.
5157	Security	The Windows Filtering Platform blocked a connection.
6005	System	The Event Log service was started (system startup).
6006	System	The Event Log service was stopped (clean shutdown).
6008	System	The previous system shutdown was unexpected.
6013	System	System uptime report.
41	System	Kernel-Power: the system rebooted without cleanly shutting down.
1074	System	A process initiated a restart or shutdown.
1076	System	The reason for an unexpected shutdown was recorded by a user.
7000	System	A service failed to start.
7001	System	A service depends on another service that failed to start.
7009	System	A service timeout occurred while waiting for it to connect.
7023	System	A service terminated with an error.
7031	System	A service terminated unexpectedly.
7034	System	A service terminated unexpectedly (crash).
7036	System	A service entered the running or stopped state.
7040	System	The start type of a service was changed.
7045	System	A new service was installed in the system.
55	System	NTFS: the file system structure on the disk is corrupt.
98	System	NTFS: the volume was checked and is healthy.
129	System	A disk controller did not respond (storport reset).
153	System	The IO operation was retried (disk).
2004	System	Resource exhaustion: low virtual memory.
1000	Application	Application error (crash).
1001	Application	Windows Error Reporting for an application fault.
1002	Application	Application hang.
11707	Application	Windows Installer: product installed successfully.
11724	Application	Windows Installer: product removed successfully.
4104	PowerShell	PowerShell script block logging.
4103	PowerShell	PowerShell module logging.
400	PowerShell	PowerShell engine state changed to Available (start).
4202	DNS	DNS server could not open a socket.
1644	Directory Service	Expensive or inefficient LDAP search.
2889	Directory Service	A client made an unsigned LDAP bind.
5136	Security	A directory service object was modified.
5137	Security	A directory service object was created.
5141	Security	A directory service object was deleted.
20	WindowsUpdateClient	Windows Update: installation failure.
19	WindowsUpdateClient	Windows Update: installation successful.
21	TerminalServices	Remote Desktop session logon succeeded.
23	TerminalServices	Remote Desktop session logoff succeeded.
24	TerminalServices	Remote Desktop session disconnected.
25	TerminalServices	Remote Desktop session reconnection succeeded.

De omschrijvingen in dit naslagwerk zijn voorlopig in het Engels.

Uitleg

Zoek op event-ID of trefwoord. De lijst bevat veelgebruikte events uit het Security-, System- en Application-logboek.

🔒 Je invoer blijft in je browser en wordt nergens naartoe gestuurd.

Veelgestelde vragen

Welk event toont een mislukte aanmelding?

Event 4625 in het Security-logboek. Veel van die events kort na elkaar kunnen wijzen op wachtwoord raden.

Wat nu?

Ook handig

Windows security baseline checkerPlak een secedit-export om wachtwoordbeleid, auditinstellingen en registerbeveiliging te controleren tegen bekende baseline-aanbevelingen.
PowerShell cheatsheetDoorzoekbare lijst met essentiële PowerShell-cmdlets voor bestanden, processen, services, de pipeline en remoting, voor PowerShell 7 en 5.1.
Linux-commando’s cheatsheetDoorzoekbare lijst met essentiële Linux-commando’s voor bestanden, rechten, tekst, processen, services, netwerk en gebruikers.
Timestamp converterZet Unix-timestamps om naar leesbare datums en terug. Toont UTC, lokale tijd en ISO 8601.

Een probleem gevonden of een suggestie? Laat het ons weten