Home > Security Measures > Configure Active Directory Auditing

Configure Active Directory Auditing

Configuring comprehensive security auditing on Domain Controllers (DCs) to enable the detection of suspicious/nefarious activities is an integral part of securing Active Directory and thus constitues an important Active Directory Security Measure.


Note - To enable and configure Active Directory auditing on DCs, Audit Policies need to be enabled in the default Domain Controllers Policy.


There are 9 audit policy categories that can be configured -


Note - In each of these categories, Advanced Audit Policy Configurations (listed below) allow for granular auditing that enables the generation of audit events for only specified portions of a particular main category, thereby skipping the generation of events that are not particularly useful.

           To use Advanced Audit Policy Configurations, the security option Audit: Force audit policy subcategory settings to override audit policy category settings must also be enabled.


  1. Audit Account Logon Events - This policy category controls the auditing of credential validation events for all domain accounts.

    1. Audit Credential Validation - This subcategory allows you to audit events generated by validation tests on user account logon credentials.

      Event IDEvent Message
      4774An account was mapped for logon.
      4775An account could not be mapped for logon.
      4776The computer attempted to validate the credentials for an account.
      4777The domain controller failed to validate the credentials for an account.

    2. Audit Kerberos Authentication Service - This subcategory allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests.

      Event IDEvent Message
      4768A Kerberos authentication ticket (TGT) was requested.
      4771Kerberos pre-authentication failed.
      4772A Kerberos authentication ticket request failed.

    3. Audit Kerberos Service Ticket Operations - This subcategory allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests submitted for user accounts.

      Event IDEvent Message
      4769A Kerberos service ticket was requested.
      4770A Kerberos service ticket was renewed.

    4. Audit Other Account Logon Events - This subcategory allows you to audit events generated by responses to credential requests submitted for a user account logon that are not credential validation or Kerberos tickets.

      Event IDEvent Message
      4649A replay attack was detected.
      4778A session was reconnected to a Window Station.
      4779A session was disconnected from a Window Station.
      4800The workstation was locked.
      4801The workstation was unlocked.
      4802The screen saver was invoked.
      4803The screen saver was dismissed.
      5378The requested credentials delegation was disallowed by policy.
      5632A request was made to authenticate to a wireless network.
      5633A request was made to authenticate to a wired network.


  2. Audit Account Management - This policy category controls the auditing of account management events for all domain accounts.

    1. Audit Application Group Management - This subcategory allows you to audit events generated by changes to application groups, such as when such a group is created, changed or deleted, or a member is added to or removed from it.

      Event IDEvent Message
      4783A basic application group was created.
      4784A basic application group was changed.
      4785A member was added to a basic application group.
      4786A member was removed from a basic application group.
      4787A non-member was added to a basic application group.
      4788A non-member was removed from a basic application group.
      4789A basic application group was deleted.
      4790An LDAP query group was created.

    2. Audit Computer Account Management - This subcategory allows you to audit events generated by changes to computer accounts, such as when a computer account is created, changed or deleted.

      Event IDEvent Message
      4741A computer account was created.
      4742A computer account was changed.
      4743A computer account was deleted.

    3. Audit Distribution Group Management - This subcategory allows you to audit events generated by changes to distribution groups, such as when such a group is created, changed or deleted, or a member is added to or removed from it.

      Event IDEvent Message
      4744A security-disabled local group was created.
      4745A security-disabled local group was changed.
      4746A member was added to a security-disabled local group.
      4747A member was removed from a security-disabled local group.
      4748A security-disabled local group was deleted.
      4749A security-disabled global group was created.
      4750A security-disabled global group was changed.
      4751A member was added to a security-disabled global group.
      4752A member was removed from a security-disabled global group.
      4753A security-disabled global group was deleted.
      4759A security-disabled universal group was created.
      4760A security-disabled universal group was changed.
      4761A member was added to a security-disabled universal group.
      4762A member was removed from a security-disabled universal group.
      4763A security-disabled universal group was deleted.

    4. Audit Other Account Management Events - This subcategory allows you to audit events generated by other user account changes that are not covered in this category, such as when the password hash of a user account is accessed.

      Event IDEvent Message
      4782The password hash an account was accessed.
      4793The Password Policy Checking API was called.

    5. Audit Security Group Management - This subcategory allows you to audit events generated by changes to security groups, such as when a security group is created, changed or deleted, or a member is added to or removed from it.

      Event IDEvent Message
      4727A security-enabled global group was created.
      4728A member was added to a security-enabled global group.
      4729A member was removed from a security-enabled global group.
      4730A security-enabled global group was deleted.
      4731A security-enabled local group was created.
      4732A member was added to a security-enabled local group.
      4733A member was removed from a security-enabled local group.
      4734A security-enabled local group was deleted.
      4735A security-enabled local group was changed.
      4737A security-enabled global group was changed.
      4754A security-enabled universal group was created.
      4755A security-enabled universal group was changed.
      4756A member was added to a security-enabled universal group.
      4757A member was removed from a security-enabled universal group.
      4758A security-enabled universal group was deleted.
      4764A group’s type was changed.

    6. Audit User Account Management - This subcategory allows you to audit events generated by changes to user accounts, such as when a user account is created, changed, deleted, renamed, disabled, enabled, locked out or unlocked, or when its password is set or changed, or when a SID is added to its SID History, or when the DSRM password is configured, or when permissions on AdminSDHolder are changed, or when Credential Manager credentials are backed up or restored.

      Event IDEvent Message
      4720A user account was created.
      4722A user account was enabled.
      4723An attempt was made to change an account's password.
      4724An attempt was made to reset an account's password.
      4725A user account was disabled.
      4726A user account was deleted.
      4738A user account was changed.
      4740A user account was locked out.
      4765SID History was added to an account.
      4766An attempt to add SID History to an account failed.
      4767A user account was unlocked.
      4780The ACL was set on accounts which are members of administrators groups.
      4781The name of an account was changed.
      4794An attempt was made to set the Directory Services Restore Mode administrator password.
      5376Credential Manager credentials were backed up.
      5377Credential Manager credentials were restored from a backup.


  3. Audit Directory Service Access - This policy category controls the auditing of access to Active Directory objects, based on their individual SACL specifications.

    1. Audit Detailed Directory Service Replication - This subcategory allows you to audit events generated by detailed Active Directory Domain Services (AD DS) replication between domain controllers.

      Event IDEvent Message
      4928An Active Directory replica source naming context was established.
      4929An Active Directory replica source naming context was removed.
      4930An Active Directory replica source naming context was modified.
      4931An Active Directory replica destination naming context was modified.
      4934Attributes of an Active Directory object were replicated.
      4935Replication failure begins.
      4936Replication failure ends.
      4937A lingering object was removed from a replica.

    2. Audit Directory Service Access - This subcategory allows you to audit events generated when an Active Directory object is accessed, based on the auditing settings specified in the object's SACL.

      Event IDEvent Message
      4662An operation was performed on an object.

    3. Audit Directory Service Changes - This subcategory allows you to audit events generated by changes to Active Directory objects, such as when an object is created, deleted, modified, moved or undeleted.

      Event IDEvent Message
      5136A directory service object was modified.
      5137A directory service object was created.
      5138A directory service object was undeleted.
      5139A directory service object was moved.
      5141A directory service object was deleted.

    4. Audit Directory Service Replication - This subcategory allows you to audit events generated during replication between two Active Directory domain controllers.

      Event IDEvent Message
      4932Synchronization of a replica of an Active Directory naming context has begun.
      4933Synchronization of a replica of an Active Directory naming context has ended.


  4. Audit Logon Events - This policy category controls the auditing of log on and log off events on Domain Controllers.

    1. Audit Access Rights - This subcategory allows you to audit system access right enforcement details during account logon.

      Event IDEvent Message
      UndocumentedUndocumented

    2. Audit Account Lockout - This subcategory allows you to audit events generated by a failed attempt to log on to and account that is locked out.

      Event IDEvent Message
      4625An account failed to log on.

    3. Audit User/Device Claims - This subcategory allows you to audit user and device claims information in a user's logon token.

      Event IDEvent Message
      4626User / Device claims information.

    4. Audit Group Membership- This subcategory allows you to audit the group memberships information in a user's logon token.

      Event IDEvent Message
      4627Group membership information.

    5. Audit IPSEC Extended Mode - This subcategory allows you to audit events generated by Internet Key Exchange (IKE) protocol and Authenticated Internet Protocol (AIP) during Extended Mode negotiations.

      Event IDEvent Message
      4978During extended mode negotiation, IPsec received an invalid negotiation packet. If this problem persists, it could indicate a network issue or an attempt to modify or replay this negotiation.
      4979IPsec main mode and extended mode security associations were established.
      4980IPsec main mode and extended mode security associations were established.
      4981IPsec main mode and extended mode security associations were established.
      4982IPsec main mode and extended mode security associations were established.
      4983An IPsec extended mode negotiation failed. The corresponding main mode security association has been deleted.
      4984An IPsec extended mode negotiation failed. The corresponding main mode security association has been deleted.

    6. Audit IPSEC Main Mode - This subcategory allows you to audit events generated by Internet Key Exchange (IKE) protocol and Authenticated Internet Protocol (AIP) during Main Mode negotiations.

      Event IDEvent Message
      4646Security ID: %1
      4650An IPsec main mode security association was established. Extended mode was not enabled. Certificate authentication was not used.
      4651An IPsec main mode security association was established. Extended mode was not enabled. A certificate was used for authentication.
      4652An IPsec main mode negotiation failed.
      4653An IPsec main mode negotiation failed.
      4655An IPsec main mode security association ended.
      4976During main mode negotiation, IPsec received an invalid negotiation packet. If this problem persists, it could indicate a network issue or an attempt to modify or replay this negotiation.
      5049An IPsec security association was deleted.
      5453An IPsec negotiation with a remote computer failed because the IKE and AuthIP IPsec Keying Modules (IKEEXT) service is not started.

    7. Audit IPSEC Quick Mode - This subcategory allows you to audit events generated by Internet Key Exchange (IKE) protocol and Authenticated Internet Protocol (AIP) during Quick Mode negotiations.

      Event IDEvent Message
      4977During quick mode negotiation, IPsec received an invalid negotiation packet. If this problem persists, it could indicate a network issue or an attempt to modify or replay this negotiation.
      5451An IPsec quick mode security association was established.
      5452An IPsec quick mode security association ended.

    8. Audit Logoff - This subcategory allows you to audit events generated by the closing of a logon session.

      Event IDEvent Message
      4634An account was logged off.
      4647User initiated logoff.

    9. Audit Logon - This subcategory allows you to audit events generated by user account logon attempts, and it includes the auditing of successful logon attempts, failed logon attempts, logon attempts using explicit credentials and filtering of SIDs.

      Event IDEvent Message
      4624An account was successfully logged on.
      4625An account failed to log on.
      4648A logon was attempted using explicit credentials.
      4675SIDs were filtered.

    10. Audit Network Policy Server - This subcategory allows you to audit events generated by RADIUS (IAS) and Network Access Protection (NAP) user access requests, which can be Grant, Deny, Discard, Quarantine, Lock and Unlock.

      Event IDEvent Message
      6272Network Policy Server granted access to a user.
      6273Network Policy Server denied access to a user.
      6274Network Policy Server discarded the request for a user.
      6275Network Policy Server discarded the accounting request for a user.
      6276Network Policy Server quarantined a user.
      6277Network Policy Server granted access to a user but put it on probation because the host did not meet the defined health policy.
      6278Network Policy Server granted full access to a user because the host met the defined health policy.
      6279Network Policy Server locked the user account due to repeated failed authentication attempts.
      6280Network Policy Server unlocked the user account.

    11. Audit Other Logon/Logoff Events - This subcategory allows you to audit events generated by other logon/logoff events that are no covered in this category, such as the establishment of a new Terminal Services sessions, the disconnection of a Terminal Services session, locking and unlocking a workstation, detection of a Kerberos replay attack, dismissal of a screen saver, access to a wireless (or a wired 802.1) network granted to a user or computer account.

      Event IDEvent Message
      4649A replay attack was detected.
      4778A session was reconnected to a Window Station.
      4779A session was disconnected from a Window Station.
      4800The workstation was locked.
      4801The workstation was unlocked.
      4802The screen saver was invoked.
      4803The screen saver was dismissed.
      5378The requested credentials delegation was disallowed by policy.
      5632A request was made to authenticate to a wireless network.
      5633A request was made to authenticate to a wired network.

    12. Audit Special Logon - This subcategory allows you to audit events generated by special logons, such as the use of a special logon i.e. a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level, or a logon by a member of a special group, a list of whose SIDS can be configured in the Registry, and if any of those SIDs are added to a token during logon, and this subcategory is enabled, then an event is logged.

      Event IDEvent Message
      4964Special groups have been assigned to a new logon.


  5. Audit Object Access - This policy category controls the auditing of access to non Active Directory objects, based on their individual SACL specifications

    1. Audit Application Generated - This subcategory allows you to audit applications that generate events using the Windows Auditing application programming interfaces (APIs).

      Event IDEvent Message
      4665An attempt was made to create an application client context.
      4666An application attempted an operation.
      4667An application client context was deleted.
      4668An application was initialized.

    2. Audit Certification Services - This subcategory allows you to audit specific Active Directory Certificate Services (AD CS) operations.

      Event IDEvent Message
      4868The certificate manager denied a pending certificate request.
      4869Certificate Services received a resubmitted certificate request.
      4870Certificate Services revoked a certificate.
      4871Certificate Services received a request to publish the certificate revocation list (CRL).
      4872Certificate Services published the certificate revocation list (CRL).
      4873A certificate request extension changed.
      4874One or more certificate request attributes changed.
      4875Certificate Services received a request to shut down.
      4876Certificate Services backup started.
      4877Certificate Services backup completed.
      4878Certificate Services restore started.
      4879Certificate Services restore completed.
      4880Certificate Services started.
      4881Certificate Services stopped.
      4882The security permissions for Certificate Services changed.
      4883Certificate Services retrieved an archived key.
      4884Certificate Services imported a certificate into its database.
      4885The audit filter for Certificate Services changed.
      4886Certificate Services received a certificate request.
      4887Certificate Services approved a certificate request and issued a certificate.
      4888Certificate Services denied a certificate request.
      4889Certificate Services set the status of a certificate request to pending.
      4890The certificate manager settings for Certificate Services changed.
      4891A configuration entry changed in Certificate Services.
      4892A property of Certificate Services changed.
      4893Certificate Services archived a key.
      4894Certificate Services imported and archived a key.
      4895Certificate Services published the CA certificate to Active Directory Domain Services.
      4896One or more rows have been deleted from the certificate database.
      4897Role separation enabled.
      4898Certificate Services loaded a template.

    3. Audit Detailed File Share - This subcategory allows you to audit attempts to access files and folders on a shared folder. If enabled, access to all shared files and folders on the system is audited.

      Event IDEvent Message
      5145A network share object was checked to see whether client can be granted desired access.

    4. Audit File Share - This subcategory allows you to audit attempts to access a shared folder. If enabled, access to all shared folders on the system is audited.

      Event IDEvent Message
      5140A network share object was accessed.
      5142A network share object was added.
      5143A network share object was modified.
      5144A network share object was deleted.
      5168Spn check for SMB/SMB2 fails.

    5. Audit File System - This subcategory allows you to audit user attempts to access file system objects, based on the auditing settings specified in the file's SACL.

      Event IDEvent Message
      4664An attempt was made to create a hard link.
      4985The state of a transaction has changed.
      5051A file was virtualized.

    6. Audit Filtering Platform Connection - This subcategory allows you to audit connections that are allowed or blocked by the Windows Filtering Platform (WFP).

      Event IDEvent Message
      5031Windows Firewall blocked an application from accepting incoming connections on the network.
      5140A network share object was accessed.
      5150The Windows Filtering Platform has blocked a packet.
      5151A more restrictive Windows Filtering Platform filter has blocked a packet.
      5154The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.
      5155The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.
      5156The Windows Filtering Platform has permitted a connection.
      5157The Windows Filtering Platform has blocked a connection.
      5158The Windows Filtering Platform has permitted a bind to a local port.
      5159The Windows Filtering Platform has blocked a bind to a local port.

    7. Audit Filtering Platform Packet Drop - This subcategory allows you to audit packets that are dropped by the Windows Filtering Platform (WFP).

      Event IDEvent Message
      5152The Windows Filtering Platform has blocked a packet.
      5153A more restrictive Windows Filtering Platform filter has blocked a packet.

    8. Audit Handle Manipulation - This subcategory allows you to audit events generated when a handle to an object is opened or closed, based on the auditing settings specified in the object's SACL.

      Event IDEvent Message
      4656A handle to an object was requested.
      4658The handle to an object was closed.
      4690An attempt was made to duplicate a handle to an object.

    9. Audit Kernel Object - This subcategory allows you to audit attempts to access the kernel (, which includes mutexes and semaphores,) based on the auditing settings specified in the kernel object's SACL.

      Event IDEvent Message
      4659A handle to an object was requested with intent to delete.
      4660An object was deleted.
      4661A handle to an object was requested.
      4663An attempt was made to access an object.

    10. Audit Other Object Access Events - This subcategory allows you to audit events generated by the management of task scheduler jobs or COM+ objects, such as job created, deleted, enabled, disabled and updated.

      Event IDEvent Message
      4671An application attempted to access a blocked ordinal through the TBS.
      4691Indirect access to an object was requested.
      4698A scheduled task was created.
      4699A scheduled task was deleted.
      4700A scheduled task was enabled.
      4701A scheduled task was disabled.
      4702A scheduled task was updated.
      5148The Windows Filtering Platform has detected a DoS attack and entered a defensive mode; packets associated with this attack will be discarded.
      5149The DoS attack has subsided and normal processing is being resumed.
      5888An object in the COM+ Catalog was modified.
      5889An object was deleted from the COM+ Catalog.
      5890An object was added to the COM+ Catalog.

    11. Audit Registry - This subcategory allows you to audit attempts to access registry objects, based on the auditing settings specified in the registry object's SACL.

      Event IDEvent Message
      4657A registry value was modified.
      5039A registry key was virtualized.

    12. Audit Removable Storage - This subcategory allows you to audit user attempts to access file system objects on a removable storage device.

      Event IDEvent Message
      4656A handle to an object was requested.
      4658The handle to an object was closed.
      4663An attempt was made to access an object.

    13. Audit SAM - This subcategory allows you to audit events generated by attempts to access Security Accounts Manager (SAM) objects, which include SAM_ALIAS, SAM_GROUP, SAM_USER, SAM_DOMAIN and SAM_SERVER.

      Event IDEvent Message
      4659A handle to an object was requested with intent to delete.
      4660An object was deleted.
      4661A handle to an object was requested.
      4663An attempt was made to access an object.

    14. Audit Central Access Policy Staging - This subcategory allows you to audit access requests where the permission granted or denied by a proposed policy differs from the current central access policy on an object.

      Event IDEvent Message
      4818Proposed Central Access Policy does not grant the same access permissions as the current Central Access Policy.


  6. Audit Policy Change - This policy category controls the auditing of changes to the user rights assignment policy, audit policy, account policy or trust policy.

    1. Audit Audit Policy Change - This subcategory allows you to audit changes in the security audit policy setting, such as setting permissions and audit settings on the Audit Policy object, changes to DACLs and SACLs, changes to the system audit policy, registration and de-registration of security event sources, changes to the per-user audit settings, changes to the value of CrashOnAuditFail, changes to the SACL on a files system or registry object and changes to the Special Groups list.

      Event IDEvent Message
      4715The audit policy (SACL) on an object was changed.
      4719System audit policy was changed.
      4817Auditing settings on object were changed.
      4902The Per-user audit policy table was created.
      4904An attempt was made to register a security event source.
      4905An attempt was made to unregister a security event source.
      4906The CrashOnAuditFail value has changed.
      4907Auditing settings on object were changed.
      4908Special Groups Logon table modified.
      4912Per User Audit Policy was changed.

    2. Audit Authentication Policy Change - This subcategory allows you to audit events generated by changes to the authentication policy, such as creation, modification or removal of forest and domain trusts, changes to the Kerberos policy, the granting of certain user rights (Access This Computer From the Network, Allow Logon Locally, Allow Logon Through Terminal Services, Logon as a Batch Job and Logon as a Service) to a user or group, and namespace collisions.

      Event IDEvent Message
      4713Kerberos policy was changed.
      4716Trusted domain information was modified.
      4717System security access was granted to an account.
      4718System security access was removed from an account.
      4739Domain Policy was changed.
      4864A namespace collision was detected.
      4865A trusted forest information entry was added.
      4866A trusted forest information entry was removed.
      4867A trusted forest information entry was modified.

    3. Audit Authorization Policy Change - This subcategory allows you to audit events generated by changes to the authorization policy, such as assignment and removal of user rights that are not audited through the Authentication Policy Change subcategory, and changes in Encrypting File System (EFS) policy, changes to the resource attributes of an object and changes to the Central Access Policy (CAP) applied to an object.

      Event IDEvent Message
      4704A user right was assigned.
      4705A user right was removed.
      4706A new trust was created to a domain.
      4707A trust to a domain was removed.
      4714Data Recovery Agent group policy for Encrypting File System (EFS) has changed. The new changes have been applied.

    4. Audit Filtering Platform Policy Change - This subcategory allows you to audit events generated by changes to the Windows Filtering Platform (WFP), such as IPSec services status, changes to IPSec policy settings, changes to Windows Firewall policy settings and changes to WFP providers and engine.

      Event IDEvent Message
      4709The IPsec Policy Agent service was started.
      4710The IPsec Policy Agent service was disabled.
      4711PAStore Engine applied Active Directory storage IPsec policy on the computer -OR- PAStore Engine failed to apply Active Directory storage IPsec policy on the computer -OR- { A few similar messages.}
      4712IPsec Policy Agent encountered a potentially serious failure.
      5040A change was made to IPsec settings. An authentication set was added.
      5041A change was made to IPsec settings. An authentication set was modified.
      5042A change was made to IPsec settings. An authentication set was deleted.
      5043A change was made to IPsec settings. A connection security rule was added.
      5044A change was made to IPsec settings. A connection security rule was modified.
      5045A change was made to IPsec settings. A connection security rule was deleted.
      5046A change was made to IPsec settings. A crypto set was added.
      5047A change was made to IPsec settings. A crypto set was modified.
      5048A change was made to IPsec settings. A crypto set was deleted.
      5440The following callout was present when the Windows Filtering Platform Base Filtering Engine started.
      5441The following filter was present when the Windows Filtering Platform Base Filtering Engine started.
      5442The following provider was present when the Windows Filtering Platform Base Filtering Engine started.
      5443The following provider context was present when the Windows Filtering Platform Base Filtering Engine started.
      5444The following sub-layer was present when the Windows Filtering Platform Base Filtering Engine started.
      5446A Windows Filtering Platform callout has been changed.
      5448A Windows Filtering Platform provider has been changed.
      5449A Windows Filtering Platform provider context has been changed.
      5450A Windows Filtering Platform sub-layer has been changed.
      5456IPsec Policy Agent applied Active Directory storage IPsec policy on the computer.
      5457IPsec Policy Agent failed to apply Active Directory storage IPsec policy on the computer.
      5458IPsec Policy Agent applied locally cached copy of Active Directory storage IPsec policy on the computer.
      5459IPsec Policy Agent failed to apply locally cached copy of Active Directory storage IPsec policy on the computer.
      5460IPsec Policy Agent applied local registry storage IPsec policy on the computer.
      5461IPsec Policy Agent failed to apply local registry storage IPsec policy on the computer.
      5462IPsec Policy Agent failed to apply some rules of the active IPsec policy on the computer. Use the IP Security Monitor snap-in to diagnose the problem.
      5463IPsec Policy Agent polled for changes to the active IPsec policy and detected no changes.
      5464IPsec Policy Agent polled for changes to the active IPsec policy, detected changes, and applied them.
      5465IPsec Policy Agent received a control for forced reloading of IPsec policy and processed the control successfully.
      5466IPsec Policy Agent polled for changes to the Active Directory IPsec policy, determined that Active Directory cannot be reached, and will use the cached copy of the Active Directory IPsec policy instead. Any changes made to the Active Directory IPsec policy since the last poll could not be applied.
      5467IPsec Policy Agent polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, and found no changes to the policy. The cached copy of the Active Directory IPsec policy is no longer being used.
      5468IPsec Policy Agent polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, found changes to the policy, and applied those changes. The cached copy of the Active Directory IPsec policy is no longer being used.
      5471IPsec Policy Agent loaded local storage IPsec policy on the computer.
      5472IPsec Policy Agent failed to load local storage IPsec policy on the computer.
      5473IPsec Policy Agent loaded directory storage IPsec policy on the computer.
      5474IPsec Policy Agent failed to load directory storage IPsec policy on the computer.
      5477IPsec Policy Agent failed to add quick mode filter.

    5. Audit MPSSVC Rule-Level Policy Change - This subcategory allows you to audit events generated by changes in policy rules used by the Microsoft Protection Service (MPSSVC), which is used by Windows Firewall, and events include reporting of active policies when Windows Firewall service starts, changes to Windows Firewall rules, changes to Windows Firewall exception list, changes to Windows Firewall settings, rules ignored or not applied by Windows Firewall Service and changes to the Windows Firewall Group Policy Settings.

      Event IDEvent Message
      4944The following policy was active when the Windows Firewall started.
      4945A rule was listed when the Windows Firewall started.
      4946A change was made to the Windows Firewall exception list. A rule was added.
      4947A change was made to the Windows Firewall exception list. A rule was modified.
      4948A change was made to the Windows Firewall exception list. A rule was deleted.
      4949Windows Firewall settings were restored to the default values.
      4950A Windows Firewall setting was changed.
      4951Windows Firewall ignored a rule because its major version number is not recognized.
      4952Windows Firewall ignored parts of a rule because its minor version number is not recognized. Other parts of the rule will be enforced.
      4953Windows Firewall ignored a rule because it could not be parsed.
      4954Group Policy settings for Windows Firewall were changed, and the new settings were applied.
      4956Windows Firewall changed the active profile.
      4957Windows Firewall did not apply the following rule.
      4958Windows Firewall did not apply the following rule because the rule referred to items not configured on this computer.

    6. Audit Other Policy Change Events - This subcategory allows you to audit events generated by other security policy changes that are not audited in the policy change category, such as Trusted Platform Module (TPM) configuration changes, Kernel-mode cryptographic self tests, Cryptographic provider operations, Cryptographic context operations or modifications, applied Central Access Policies (CAPs) changes and Boot Configuration Data (BCD) modifications.

      Event IDEvent Message
      4670Permissions on an object were changed.
      4909The local policy settings for the TBS were changed.
      4910The group policy settings for the TBS were changed.
      5063A cryptographic provider operation was attempted.
      5064A cryptographic context operation was attempted.
      5065A cryptographic context modification was attempted.
      5066A cryptographic function operation was attempted.
      5067A cryptographic function modification was attempted.
      5068A cryptographic function provider operation was attempted.
      5069A cryptographic function property operation was attempted.
      5070A cryptographic function property modification was attempted.
      5447A Windows Filtering Platform filter has been changed.
      6144Security policy in the group policy objects has been applied successfully.
      6145One or more errors occured while processing security policy in the group policy objects.


  7. Audit Privilege Use - This policy category controls the auditing of each instance of a user exercising user rights.

    Note - Even if configured, by default, audit events are not generated when the following user rights are exercised - Bypass traverse checking, Debug programs, Create a token object, Replace process level token, Generate security audits, Backup files and directories and Restore files and directories
               To enable the auditing of these user rights, one must enable the registry key FullPrivilegeAuditing

    1. Audit Non Sensitive Privilege Use - This subcategory allows you to audit events generated by the use of non-sensitive privileges (user rights).

      Event IDEvent Message
      4672Special privileges assigned to new logon.
      4673A privileged service was called.
      4674An operation was attempted on a privileged object.

    2. Audit Other Privilege Use Events - This subcategory is not currently in use.


    3. Audit Sensitive Privilege Use - This subcategory allows you to audit events generated by the use of sensitive privileges (user rights).

      Event IDEvent Message
      4672Special privileges assigned to new logon.
      4673A privileged service was called.
      4674An operation was attempted on a privileged object.


  8. Audit Process Tracking - This policy category controls the auditing of various process related events, such as process creation, termination, handle duplication and indirect object access.

    1. Audit DPAPI Activity - This subcategory allows you to audit events generated when encryption or decryption requests are made to the Data Protection Application Programming Interface (DPAPI)

      Event IDEvent Message
      4692Backup of data protection master key was attempted.
      4693Recovery of data protection master key was attempted.
      4694Protection of auditable protected data was attempted.
      4695Unprotection of auditable protected data was attempted.

    2. Audit PNP Activity - This subcategory allows you to audit events generated whenever plug and play detectes and external device.

      Event IDEvent Message
      6416A new external device was recognized by the system.

    3. Audit Process Creation - This subcategory allows you to audit events generated when a process is created or started.

      Event IDEvent Message
      4688A new process has been created.
      4696A primary token was assigned to process.

    4. Audit Process Termination - This subcategory allows you to audit events generated when a process ends.

      Event IDEvent Message
      4689A process has exited.

    5. Audit RPC Events - This subcategory allows you to audit events generated whenever a remote RPC connection is attempted.

      Event IDEvent Message
      5712A Remote Procedure Call (RPC) was attempted.

    6. Audit Token Right Adjusted Events - This subcategory allows you to audit events generated by adjusting the privileges of a token.

      Event IDEvent Message
      4703A token right was adjusted.


  9. Audit System Events - This policy category controls the auditing of specific system events - attempted system time change, attempted security system startup or shutdown, attempt to load extensible authentication components, loss of audited events due to auditing system failure and the security log size exceeding a configurable warning threshold event.

    1. Audit IPSec Driver - This subcategory allows you to audit events generated by the IPsec filter, such as when the IPSec service startsup or shuts down, or when network packets are dropped due to integrity check failure, or replay check failure or being in plaintext, or when network packets are received with an incorrect Security Parameter Index (SPI), or due to the inability to process IPsec filters.

      Event IDEvent Message
      4960IPsec dropped an inbound packet that failed an integrity check. If this problem persists, it could indicate a network issue or that packets are being modified in transit to this computer. Verify that the packets sent from the remote computer are the same as those received by this computer. This error might also indicate interoperability problems with other IPsec implementations.
      4961IPsec dropped an inbound packet that failed a replay check. If this problem persists, it could indicate a replay attack against this computer.
      4962IPsec dropped an inbound packet that failed a replay check. The inbound packet had too low a sequence number to ensure it was not a replay.
      4963IPsec dropped an inbound clear text packet that should have been secured. If the remote computer is configured with a Request Outbound IPsec policy, this might be benign and expected. This can also be caused by the remote computer changing its IPsec policy without informing this computer. This could also be a spoofing attack attempt.
      4965IPsec received a packet from a remote computer with an incorrect Security Parameter Index (SPI). This is usually caused by malfunctioning hardware that is corrupting packets. If these errors persist, verify that the packets sent from the remote computer are the same as those received by this computer. This error might also indicate interoperability problems with other IPsec implementations. In that case, if connectivity is not impeded, then these events can be ignored.
      5478The IPsec Policy Agent service was started.
      5479The IPsec Policy Agent service was stopped. Stopping this service can put the computer at greater risk of network attack or expose the computer to potential security risks.
      5480IPsec Policy Agent failed to get the complete list of network interfaces on the computer. This poses a potential security risk because some of the network interfaces may not get the protection provided by the applied IPsec filters. Use the IP Security Monitor snap-in to diagnose the problem.
      5483The IPsec Policy Agent service failed to initialize its RPC server. The service could not be started.
      5484The IPsec Policy Agent service experienced a critical failure and has shut down. The shutdown of this service can put the computer at greater risk of network attack or expose the computer to potential security risks.
      5485IPsec Policy Agent failed to process some IPsec filters on a plug-and-play event for network interfaces. This poses a potential security risk because some of the network interfaces may not get the protection provided by the applied IPsec filters. Use the IP Security Monitor snap-in to diagnose the problem.

    2. Audit Other System Events - This subcategory allows you to audit the following events - Startup and shutdown of the Windows Firewall service and driver, Security prolicy processing by the Windows Firewall Service and Cryptography key file and migration operations.

      Event IDEvent Message
      5024The Windows Firewall service started successfully.
      5025The Windows Firewall service was stopped.
      5027The Windows Firewall service was unable to retrieve the security policy from the local storage. Windows Firewall will continue to enforce the current policy.
      5028Windows Firewall was unable to parse the new security policy. Windows Firewall will continue to enforce the current policy.
      5029The Windows Firewall service failed to initialize the driver. Windows Firewall will continue to enforce the current policy.
      5030The Windows Firewall service failed to start.
      5032Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network.
      5033The Windows Firewall Driver started successfully.
      5034The Windows Firewall Driver was stopped.
      5035The Windows Firewall Driver failed to start.
      5037The Windows Firewall Driver detected a critical runtime error, terminating.
      5058Key file operation.
      5059Key migration operation.
      6400BranchCache: Received an incorrectly formatted response while discovering availability of content.
      6401BranchCache: Received invalid data from a peer. Data discarded.
      6402BranchCache: The message to the hosted cache offering it data is incorrectly formatted.
      6403BranchCache: The hosted cache sent an incorrectly formatted response to the client's message to offer it data.
      6404BranchCache: Hosted cache could not be authenticated using the provisioned SSL certificate.
      6405BranchCache: %2 instance(s) of event id %1 occurred.
      6406%1 registered to Windows Firewall to control filtering for the following.
      6407%1
      6408Registered product %1 failed and Windows Firewall is now controlling the filtering for %2.

    3. Audit Security State Change - This subcategory allows you to audit events generated by changes in the security state of the computer, such as the startup and shutdown of the computer, a change of the system time, recovering the system from CrashOnAuditFail, which is logged after a system restarts when the security event log is full and the CrashOnAuditFail registry entry is configured.

      Event IDEvent Message
      4608Windows is starting up.
      4609Windows is shutting down.
      4616The system time was changed.
      4621Administrator recovered system from CrashOnAuditFail. Users who are not administrators will now be allowed to log on. Some auditable activity might not have been recorded.

    4. Audit Security System Extension - This subcategory allows you to audit events related to security system extensions, such as when an authentication notification or security package is loaded and is registered with the Local System Authority (LSA), or when a service is installed and registered with the Service Control Manager (SCM). A security system extension (e.g. Kerberos, NTLM) is used to authenticate logon attempts, submit logon requests, and account or password changes.

      Event IDEvent Message
      4610An authentication package has been loaded by the Local Security Authority.
      4611A trusted logon process has been registered with the Local Security Authority.
      4614A notification package has been loaded by the Security Account Manager.
      4622A security package has been loaded by the Local Security Authority.
      4697A service was installed in the system.

    5. Audit System Integrity - This subcategory allows you to audit events that violate the integrity of the security subsystem, such as events that could not be written to the event log because of a problem with the auditing system, a process that uses a LPC port that is not valid in an attempt to impersonate a client by replying, reading, writing to or from a client address space, the detection of a RPC that compromises system integrity, the detection of a hash value of an executable file that is not valid as determined by Code Integrity, or cryptographic operations that compromise system integrity.

      Event IDEvent Message
      4612Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits.
      4615Invalid use of LPC port.
      4618A monitored security event pattern has occurred.
      4816RPC detected an integrity violation while decrypting an incoming message.
      5038Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.
      5056A cryptographic self test was performed.
      5057A cryptographic primitive operation failed.
      5060Verification operation failed.
      5061Cryptographic operation.
      5062A kernel-mode cryptographic self test was performed.
      6281Code Integrity determined that the page hashes of an image file are not valid. The file could be improperly signed without page hashes or corrupt due to unauthorized modification. The invalid hashes could indicate a potential disk device error.