Event ID reference and Get-WinEvent query builder

Tick the events you are after and get a PowerShell query that runs as is: FilterHashtable when that is enough, FilterXml when you filter on a field such as TargetUserName. Every event lists what it means, which audit policy has to be on, and where it is logged. Everything runs in your browser.

Start from:
Logon and logoff

Every successful logon. LogonType tells you how: 2 at the console, 3 over the network (file shares), 10 over RDP.

Security log · Audit: Logon/Logoff › Audit Logon (Success) · The computer that was logged on to

A failed logon. Status and SubStatus give the reason (wrong password, locked out, disabled); IpAddress and WorkstationName show where it came from.

Security log · Audit: Logon/Logoff › Audit Logon (Failure) · The computer that was logged on to

A logon session ended. Network logons (type 3) end constantly, so expect volume.

Security log · Audit: Logon/Logoff › Audit Logoff · The computer the session was on

A user signed out of an interactive session themselves.

Security log · Audit: Logon/Logoff › Audit Logoff · The computer the session was on

Someone used credentials other than their own: runas, a mapped drive with other credentials, or a script authenticating as a service account.

Security log · Audit: Logon/Logoff › Audit Logon · The computer the credentials were used on

An administrator-equivalent logon: the session received sensitive privileges such as SeDebugPrivilege. Useful for tracking admin activity.

Security log · Audit: Logon/Logoff › Audit Special Logon · The computer that was logged on to

An RDP or fast-user-switching session was reconnected. ClientName and ClientAddress identify the connecting machine.

Security log · Audit: Logon/Logoff › Audit Other Logon/Logoff Events · The computer hosting the session

An RDP or fast-user-switching session was disconnected without logging off.

Security log · Audit: Logon/Logoff › Audit Other Logon/Logoff Events · The computer hosting the session

The user locked the screen (or it locked on timeout).

Security log · Audit: Logon/Logoff › Audit Other Logon/Logoff Events · The workstation

The user unlocked the screen.

Security log · Audit: Logon/Logoff › Audit Other Logon/Logoff Events · The workstation

Lockouts and passwords

An account hit the lockout threshold. The "Caller Computer Name" (the TargetDomainName field) is the machine the bad passwords came from: start there.

Security log · Audit: Account Management › Audit User Account Management · Domain controllers; the PDC emulator sees every domain lockout

Someone unlocked an account. SubjectUserName is who did it.

Security log · Audit: Account Management › Audit User Account Management · The domain controller that processed the change

A user changed their own password (they knew the old one). Logged for success and failure.

Security log · Audit: Account Management › Audit User Account Management · The domain controller that processed the change

Someone reset another account's password, usually the helpdesk. SubjectUserName is who did it.

Security log · Audit: Account Management › Audit User Account Management · The domain controller that processed the change

Kerberos and NTLM

The first step of a domain logon. A non-zero Status is a failure; TicketEncryptionType 0x17 means RC4.

Security log · Audit: Account Logon › Audit Kerberos Authentication Service · Domain controllers

An account asked for a ticket to a service. Many RC4 (0x17) requests for service accounts can be a sign of Kerberoasting.

Security log · Audit: Account Logon › Audit Kerberos Service Ticket Operations · Domain controllers

A Kerberos logon failed before a ticket was issued. Status 0x18 is a wrong password; IpAddress is the client that sent it. The usual source behind a lockout.

Security log · Audit: Account Logon › Audit Kerberos Authentication Service (Failure) · Domain controllers

NTLM credential validation. Status 0xC000006A is a wrong password; Workstation is the client name it reported.

Security log · Audit: Account Logon › Audit Credential Validation · Domain controllers (domain accounts) or the local machine (local accounts)

User accounts

A new user account. SubjectUserName is who created it.

Security log · Audit: Account Management › Audit User Account Management · Domain controllers (domain accounts) or the local machine

A disabled account was enabled.

Security log · Audit: Account Management › Audit User Account Management · Domain controllers (domain accounts) or the local machine

An account was disabled.

Security log · Audit: Account Management › Audit User Account Management · Domain controllers (domain accounts) or the local machine

An account was deleted.

Security log · Audit: Account Management › Audit User Account Management · Domain controllers (domain accounts) or the local machine

Account properties changed, such as userAccountControl flags or the UPN. Fields that did not change show as "-".

Security log · Audit: Account Management › Audit User Account Management · Domain controllers (domain accounts) or the local machine

An account was renamed (its sAMAccountName changed).

Security log · Audit: Account Management › Audit User Account Management · Domain controllers (domain accounts) or the local machine

A process read which local groups a user belongs to. Normal for some tools; bursts from unusual processes can mean reconnaissance.

Security log · Audit: Account Management › Audit User Account Management · The machine whose local groups were read

Groups

Someone was added to a global security group, such as Domain Admins. TargetUserName is the group, MemberName the member.

Security log · Audit: Account Management › Audit Security Group Management · Domain controllers

Someone was removed from a global security group.

Security log · Audit: Account Management › Audit Security Group Management · Domain controllers

Someone was added to a domain local group, or to a local group such as Administrators on a member server or workstation.

Security log · Audit: Account Management › Audit Security Group Management · Domain controllers (domain local groups) or the local machine

Someone was removed from a domain local or local group.

Security log · Audit: Account Management › Audit Security Group Management · Domain controllers (domain local groups) or the local machine

Someone was added to a universal security group, such as Enterprise Admins.

Security log · Audit: Account Management › Audit Security Group Management · Domain controllers

Someone was removed from a universal security group.

Security log · Audit: Account Management › Audit Security Group Management · Domain controllers

A new global security group.

Security log · Audit: Account Management › Audit Security Group Management · Domain controllers

A process listed the members of a local group, for example Administrators. Watch for unusual CallerProcessName values.

Security log · Audit: Account Management › Audit Security Group Management · The machine whose group was read

Computer accounts

A computer joined the domain or an account was pre-staged. SubjectUserName is who did it.

Security log · Audit: Account Management › Audit Computer Account Management · Domain controllers

Computer account properties changed. Frequent and mostly routine (password changes, SPN updates).

Security log · Audit: Account Management › Audit Computer Account Management · Domain controllers

A computer account was removed from the domain.

Security log · Audit: Account Management › Audit Computer Account Management · Domain controllers

Directory changes

An attribute changed on an AD object: who changed what, with the old value (OperationType %%14675) and the new one (%%14674). Needs a SACL on the objects you want audited.

Security log · Audit: DS Access › Audit Directory Service Changes, plus a SACL on the objects · The domain controller that made the change

A new AD object was created.

Security log · Audit: DS Access › Audit Directory Service Changes, plus a SACL on the objects · The domain controller that made the change

An AD object moved to a different OU or container.

Security log · Audit: DS Access › Audit Directory Service Changes, plus a SACL on the objects · The domain controller that made the change

An AD object was deleted.

Security log · Audit: DS Access › Audit Directory Service Changes, plus a SACL on the objects · The domain controller that made the change

Access to an AD object that has a SACL. High volume. Replication-right GUIDs in Properties from a non-DC account are the classic DCSync signal.

Security log · Audit: DS Access › Audit Directory Service Access, plus a SACL on the objects · Domain controllers

Policy and audit log

Someone changed what the machine audits. Unexpected changes deserve a look.

Security log · Audit: Policy Change › Audit Audit Policy Change · The machine whose policy changed

Domain password, lockout or Kerberos policy changed.

Security log · Audit: Policy Change › Audit Authentication Policy Change · Domain controllers

Someone cleared the Security log. Always worth an explanation. Logged regardless of audit policy; the user is in the event message.

Security log · Microsoft-Windows-Eventlog · Logged without an audit policy · The machine whose log was cleared

Someone cleared an event log other than Security (the log name is in the message).

System log · Microsoft-Windows-Eventlog · Logged without an audit policy · The machine whose log was cleared

Services, tasks and processes

A new service was installed. Logged without any audit policy. ImagePath shows what it runs; attackers often install services for persistence or remote execution.

System log · Service Control Manager · Logged without an audit policy · The machine the service was installed on

The Security-log version of 7045, with the account that installed it.

Security log · Audit: System › Audit Security System Extension · The machine the service was installed on

A new scheduled task. TaskContent holds the task XML, including the command it runs.

Security log · Audit: Object Access › Audit Other Object Access Events · The machine the task was created on

An existing scheduled task changed. TaskContentNew holds the new definition.

Security log · Audit: Object Access › Audit Other Object Access Events · The machine the task is on

Every process start. CommandLine is filled in only if "Include command line in process creation events" is enabled. High volume.

Security log · Audit: Detailed Tracking › Audit Process Creation · The machine the process ran on

Startup, shutdown and updates

Who or what restarted the machine, and the reason given. param1 is the process, param3 the reason, param7 the user.

System log · User32 · Logged without an audit policy · The machine that restarted

Logged at every boot, so it works as a "machine started" marker.

System log · EventLog · Logged without an audit policy · The machine

Logged at a clean shutdown.

System log · EventLog · Logged without an audit policy · The machine

Written at boot when the machine did not shut down cleanly: power loss, a crash or a hard reset.

System log · EventLog · Logged without an audit policy · The machine

Kernel-Power 41: the system lost power or stopped responding. A non-zero BugcheckCode means it was a blue screen.

System log · Microsoft-Windows-Kernel-Power · Logged without an audit policy · The machine

An update installed successfully. updateTitle includes the KB number.

System log · Microsoft-Windows-WindowsUpdateClient · Logged without an audit policy · The machine

An update failed to install. errorCode is the HRESULT to look up.

System log · Microsoft-Windows-WindowsUpdateClient · Logged without an audit policy · The machine

Only where (exact match)

A filter applies to every selected event in the same log; events without that field won't match.

# Events:
#   4740 A user account was locked out
$filter = @{
    LogName   = 'Security'
    Id        = 4740
    StartTime = (Get-Date).AddDays(-1)
}

$events = Get-WinEvent -FilterHashtable $filter -ErrorAction SilentlyContinue

$events | ForEach-Object {
    # EventData fields by name, so the columns do not depend on field order
    $data = @{}
    foreach ($d in ([xml]$_.ToXml()).Event.EventData.Data) { if ($d.Name) { $data[$d.Name] = $d.'#text' } }
    [pscustomobject]@{
        TimeCreated      = $_.TimeCreated
        Computer         = $_.MachineName
        Id               = $_.Id
        TargetUserName   = $data['TargetUserName']
        TargetDomainName = $data['TargetDomainName']
        SubjectUserName  = $data['SubjectUserName']
    }
} | Sort-Object TimeCreated -Descending | Format-Table -AutoSize -Wrap

Run it in an elevated PowerShell session: reading the Security log needs admin rights or Event Log Readers membership.

Codes you will see in these events

LogonType (4624, 4625, 4634)

2Interactive: at the keyboard
3Network: file share, most remote management
4Batch: scheduled task
5Service: a service started under this account
7Unlock
8NetworkCleartext: password sent in clear (often IIS basic auth)
9NewCredentials: runas /netonly
10RemoteInteractive: RDP
11CachedInteractive: cached credentials, no DC reachable

Status and SubStatus (4625, 4776)

0xC000006AWrong password
0xC0000064User name does not exist
0xC000006DGeneric logon failure: check SubStatus
0xC0000234Account is locked out
0xC0000072Account is disabled
0xC0000193Account has expired
0xC0000071Password has expired
0xC0000224User must change password at next logon
0xC000006FOutside allowed logon hours
0xC0000070Not allowed to log on from this workstation
0xC000015BLogon type not granted on this machine
0xC0000133Clock out of sync with the domain controller

Kerberos failure codes (4768, 4771)

0x6Client not found in the directory (bad user name)
0x12Account disabled, expired or locked out
0x17Password has expired
0x18Pre-authentication failed: wrong password
0x25Clock skew too great