Event Log – Event IDs

Common Event IDs on Server Side 4624 – An account was successfully logged on 4625 – An account failed to logon 4771 – Kerberos pre-authentication failed 4776 – The domain controller attempted to validate the credentials for an account   Sample Queries <QueryList> <Query Id=”0″ Path=”Security”> <Select Path=”Security”> *[System[(Level=1 or Level=2 or Level=3…

Continue reading