Title: Windows Security Audit Events Spreadsheet
Publisher: Microsoft Corporation
Version: November 2015
File name: WindowsSecurityAuditEvents.xlsx
Size: 70 KB
Download URL: Click here for download
1) What’s the Event ID for an Account Lockout?
2) What about the Event ID denoting that permissions were changed on an object?
3) Or the Event ID for locking or unlocking a workstation?
Don’t worry, I can’t remember those off the top of my head either. And that usually means sifting through bookmarked links, PDFs or hitting Google to look it up.
Fortunately, Microsoft has an Excel spreadsheet detailing 412 different Event IDs related to Windows Security Audit Events. Those 400+ Event IDs are broken up into the following nine categories:
- Account Logon
- Account Management
- Detailed Tracking
- DS Access
- Object Access
- Policy Change
- Privilege Use
The spreadsheet also contains a tab with a complete description of the event message. This is a great tool for creating event monitors. Download and enjoy!