Windows Event ID lookup
Look up common Windows Event IDs: logon, account changes, services, Kerberos, RDP and PowerShell. Useful for troubleshooting and security audits.
Runs in your browser · nothing is sentWindows logs & config
81 results
| Event ID | Log | Description |
|---|---|---|
| 4624 | Security | An account was successfully logged on. |
| 4625 | Security | An account failed to log on. Many in a row can indicate brute-forcing. |
| 4634 | Security | An account was logged off. |
| 4647 | Security | User initiated logoff. |
| 4648 | Security | A logon was attempted using explicit credentials (runas, RDP). |
| 4672 | Security | Special privileges assigned to a new logon (administrator-level). |
| 4720 | Security | A user account was created. |
| 4722 | Security | A user account was enabled. |
| 4723 | Security | An attempt was made to change an account password. |
| 4724 | Security | An attempt was made to reset an account password. |
| 4725 | Security | A user account was disabled. |
| 4726 | Security | A user account was deleted. |
| 4728 | Security | A member was added to a security-enabled global group. |
| 4732 | Security | A member was added to a security-enabled local group (for example Administrators). |
| 4738 | Security | A user account was changed. |
| 4740 | Security | A user account was locked out. |
| 4756 | Security | A member was added to a security-enabled universal group. |
| 4767 | Security | A user account was unlocked. |
| 4768 | Security | A Kerberos authentication ticket (TGT) was requested. |
| 4769 | Security | A Kerberos service ticket was requested. |
| 4771 | Security | Kerberos pre-authentication failed. |
| 4776 | Security | The computer attempted to validate credentials (NTLM). |
| 4656 | Security | A handle to an object was requested. |
| 4663 | Security | An attempt was made to access an object (file auditing). |
| 4698 | Security | A scheduled task was created. |
| 4699 | Security | A scheduled task was deleted. |
| 4700 | Security | A scheduled task was enabled. |
| 4702 | Security | A scheduled task was updated. |
| 4688 | Security | A new process was created (needs process auditing). |
| 4689 | Security | A process has exited. |
| 4697 | Security | A service was installed on the system. |
| 4719 | Security | System audit policy was changed. |
| 4739 | Security | Domain policy was changed. |
| 1102 | Security | The audit log was cleared. Often a sign of tampering. |
| 4616 | Security | The system time was changed. |
| 5140 | Security | A network share object was accessed. |
| 5142 | Security | A network share object was added. |
| 5145 | Security | A network share object was checked for access. |
| 5156 | Security | The Windows Filtering Platform allowed a connection. |
| 5157 | Security | The Windows Filtering Platform blocked a connection. |
| 6005 | System | The Event Log service was started (system startup). |
| 6006 | System | The Event Log service was stopped (clean shutdown). |
| 6008 | System | The previous system shutdown was unexpected. |
| 6013 | System | System uptime report. |
| 41 | System | Kernel-Power: the system rebooted without cleanly shutting down. |
| 1074 | System | A process initiated a restart or shutdown. |
| 1076 | System | The reason for an unexpected shutdown was recorded by a user. |
| 7000 | System | A service failed to start. |
| 7001 | System | A service depends on another service that failed to start. |
| 7009 | System | A service timeout occurred while waiting for it to connect. |
| 7023 | System | A service terminated with an error. |
| 7031 | System | A service terminated unexpectedly. |
| 7034 | System | A service terminated unexpectedly (crash). |
| 7036 | System | A service entered the running or stopped state. |
| 7040 | System | The start type of a service was changed. |
| 7045 | System | A new service was installed in the system. |
| 55 | System | NTFS: the file system structure on the disk is corrupt. |
| 98 | System | NTFS: the volume was checked and is healthy. |
| 129 | System | A disk controller did not respond (storport reset). |
| 153 | System | The IO operation was retried (disk). |
| 2004 | System | Resource exhaustion: low virtual memory. |
| 1000 | Application | Application error (crash). |
| 1001 | Application | Windows Error Reporting for an application fault. |
| 1002 | Application | Application hang. |
| 11707 | Application | Windows Installer: product installed successfully. |
| 11724 | Application | Windows Installer: product removed successfully. |
| 4104 | PowerShell | PowerShell script block logging. |
| 4103 | PowerShell | PowerShell module logging. |
| 400 | PowerShell | PowerShell engine state changed to Available (start). |
| 4202 | DNS | DNS server could not open a socket. |
| 1644 | Directory Service | Expensive or inefficient LDAP search. |
| 2889 | Directory Service | A client made an unsigned LDAP bind. |
| 5136 | Security | A directory service object was modified. |
| 5137 | Security | A directory service object was created. |
| 5141 | Security | A directory service object was deleted. |
| 20 | WindowsUpdateClient | Windows Update: installation failure. |
| 19 | WindowsUpdateClient | Windows Update: installation successful. |
| 21 | TerminalServices | Remote Desktop session logon succeeded. |
| 23 | TerminalServices | Remote Desktop session logoff succeeded. |
| 24 | TerminalServices | Remote Desktop session disconnected. |
| 25 | TerminalServices | Remote Desktop session reconnection succeeded. |
The descriptions in this reference are currently in English.
About this tool
Search by event ID or keyword. The list covers frequently used events from the Security, System and Application logs.
🔒 Your input stays in your browser and is never sent anywhere.
Frequently asked questions
Which event shows a failed logon?
Event 4625 in the Security log. Many of them in a short time can indicate password guessing.
What to do next
Found a problem or have a suggestion? Tell us