Windows 2000 security event descriptions from the security event log. These events will appear with the security event source. Most of of the event descriptions listed here also apply to Windows XP and Windows Server 2003.
Event ID: 512 (0x0200)
Type: Success Audit
Description: Windows NT is starting up.
Event ID: 513 (0x0201)
Type: Success Audit
Description: Windows NT is shutting down.
All logon sessions will be terminated by this shutdown.
Event ID: 514 (0x0202)
Type: Success Audit
Description: An authentication package has been loaded by the Local Security Authority.
This authentication package will be used to authenticate logon attempts.
Authentication Package Name: %1
Event ID: 515 (0x0203)
Type: Success Audit
Description: A trusted logon process has registered with the Local Security Authority.
This logon process will be trusted to submit logon requests.
Logon Process Name: %1
Event ID: 516 (0x0204)
Type: Success Audit
Description: Internal resources allocated for the queuing of audit messages have been
exhausted, leading to the loss of some audits.
Number of audit messages discarded: %1
Event ID: 517 (0x0205)
Type: Success Audit
Description: The audit log was cleared
Primary User Name: %1 Primary Domain: %2
Primary Logon ID: %3 Client User Name: %4
Client Domain: %5 Client Logon ID: %6
Event ID: 518 (0x0206)
Type: Success Audit
Description: An notification package has been loaded by the Security Account Manager.
This package will be notified of any account or password changes.
Notification Package Name: %1
Event ID: 528 (0x0210)
Type: Success Audit
Description: Successful Logon:
User Name: %1 Domain: %2
Logon ID: %3 Logon Type: %4
Logon Process: %5 Authentication Package: %6
Workstation Name: %7
Event ID: 529 (0x0211)
Type: Failure Audit
Description: Logon Failure
Reason: Unknown user name or bad password
User Name: %1 Domain: %2
Logon Type: %3 Logon Process: %4
Authentication Package: %5 Workstation Name: %6
Event ID: 530 (0x0212)
Type: Failure Audit
Description: Logon Failure
Reason: Account logon time restriction violation
User Name: %1 Domain: %2
Logon Type: %3 Logon Process: %4
Authentication Package: %5 Workstation Name: %6
Event ID: 531 (0x0213)
Type: Failure Audit
Description: Logon Failure
Reason: Account currently disabled
User Name: %1 Domain: %2
Logon Type: %3 Logon Process: %4
Authentication Package: %5 Workstation Name: %6
Event ID: 532 (0x0214)
Type: Failure Audit
Description: Logon Failure
Reason: The specified user account has expired
User Name: %1 Domain: %2
Logon Type: %3 Logon Process: %4
Authentication Package: %5 Workstation Name: %6
Event ID: 533 (0x0215)
Type: Failure Audit
Description: Logon Failure
Reason: User not allowed to logon at this computer
User Name: %1 Domain: %2
Logon Type: %3 Logon Process: %4
Authentication Package: %5 Workstation Name: %6
Event ID: 534 (0x0216)
Type: Failure Audit
Description: Logon Failure
Reason:The user has not been granted the requested
logon type at this machine
User Name: %1 Domain: %2
Logon Type: %3 Logon Process: %4
Authentication Package: %5 Workstation Name: %6
Event ID: 535 (0x0217)
Type: Failure Audit
Description: Logon Failure
Reason: The specified account's password has expired
User Name: %1 Domain: %2
Logon Type: %3 Logon Process: %4
Authentication Package: %5 Workstation Name: %6
Event ID: 536 (0x0218)
Type: Failure Audit
Description: Logon Failure
Reason: The NetLogon component is not active
User Name: %1 Domain: %2
Logon Type: %3 Logon Process: %4
Authentication Package: %5 Workstation Name: %6
Event ID: 537 (0x0219)
Type: Failure Audit
Description: Logon Failure
Reason: An unexpected error occurred during logon
User Name: %1 Domain: %2
Logon Type: %3 Logon Process: %4
Authentication Package: %5 Workstation Name: %6
Event ID: 538 (0x021A)
Type: Success Audit
Description: User Logoff
User Name: %1 Domain: %2
Logon ID: %3 Logon Type: %4.
Event ID: 539 (0x021B)
Type: Failure Audit
Description: Logon Failure
Reason: Account locked out
User Name: %1 Domain: %2
Logon Type: %3 Logon Process: %4
Authentication Package: %5 Workstation Name: %6
Event ID: 540 (0x021c)
Type: Success Audit
Description: Successful Network Logon
User Name: %1 Domain: %2
Logon ID: %3 Logon Type: %4
Logon Process: %5 Authentication Package: %6
Workstation Name: %7
Event ID: 541 (0x021d)
Type: Success Audit
Description: IKE security association established.
Mode: %1 Peer Identity: %2
Filter: %3 Parameters: %4
Event ID: 542 (0x021e)
Type: Success Audit
Description: IKE security association ended.
Mode: Data Protection (Quick mode)
Filter: %1 Inbound SPI: %2
Outbound SPI: %3
Event ID: 543 (0x021f)
Type: Success Audit
Description: IKE security association ended.
Mode: Key Exchange (Main mode)
Filter: %1
Event ID: 544 (0x0220)
Type: Failure Audit
Description: IKE security association establishment failed because peer could not
authenticate. The certificate trust could not be established.
Peer Identity: %1 Filter: %2
Event ID: 545 (0x0221)
Type: Failure Audit
Description: IKE peer authentication failed.
Peer Identity: %1 Filter: %2
Event ID: 546 (0x0222)
Type: Failure Audit
Description: IKE security association establishment failed because peer
sent invalid proposal.
Mode: %1 Filter: %2
Attribute: %3 Expected value: %4
Received value: %5
Event ID: 547 (0x0223)
Type: Failure Audit
Description: IKE security association negotiation failed.
Mode: %1 Filter: %2
Failure Point: %3 Failure Reason: %4
Event ID: 560 (0x0230)
Type: Success Audit
Description: Object Open
Object Server: %1 Object Type: %2
Object Name: %3 New Handle ID: %4
Operation ID:{%5,%6} Process ID: %7
Primary User Name: %8 Primary Domain: %9
Primary Logon ID: %10 Client User Name: %11
Client Domain: %12 Client Logon ID: %13
Accesses %14 Privileges %15
Event ID: 561 (0x0231)
Type: Success Audit
Description: Handle Allocated
Handle ID: %1 Operation ID:{%2,%3}
Process ID: %4
Event ID: 562 (0x0232)
Type: Success Audit
Description: Handle Closed
Object Server: %1 Handle ID: %2
Process ID: %3
Event ID: 563 (0x0233)
Type: Success Audit
Description: Object Open for Delete
Object Server: %1 Object Type: %2
Object Name: %3 New Handle ID: %4
Operation ID:{%5,%6} Process ID: %7
Primary User Name: %8 Primary Domain: %9
Primary Logon ID: %10 Client User Name: %11
Client Domain: %12 Client Logon ID: %13
Accesses %14 Privileges %15
Event ID: 564 (0x0234)
Type: Success Audit
Description: Object Deleted
Object Server: %1 Handle ID: %2
Process ID: %3
Event ID: 565 (0x0235)
Type: Success Audit
Description: Object Open
Object Server: %1 Object Type: %2
Object Name: %3 New Handle ID: %4
Operation ID:{%5,%6} Process ID: %7
Primary User Name: %8 Primary Domain: %9
Primary Logon ID: %10 Client User Name: %11
Client Domain: %12 Client Logon ID: %13
Accesses %14 Privileges %15
Properties:%16%17%18%19%20%21%22%23%24%25
Event ID: 566 (0x0236)
Type: Success Audit
Description: Object Operation
Operation Type %1 Object Type: %2
Object Name: %3 Handle ID: %4
Operation ID:{%5,%6} Primary User Name: %7
Primary Domain: %8 Primary Logon ID: %9
Client User Name: %10 Client Domain: %11
Client Logon ID: %12 Requested Accesses %13
Event ID: 576 (0x0240)
Type: Success Audit
Description: Special privileges assigned to new logon:
User Name: %1 Domain: %2
Logon ID: %3 Assigned: %4
Event ID: 577 (0x0241)
Type: Success Audit
Description: Privileged Service Called
Server: %1 Service: %2
Primary User Name: %3 Primary Domain: %4
Primary Logon ID: %5 Client User Name: %6
Client Domain: %7 Client Logon ID: %8
Privileges: %9
Event ID: 578 (0x0242)
Type: Success Audit
Description: Privileged object operation
Object Server: %1 Object Handle: %2
Process ID: %3 Primary User Name: %4
Primary Domain: %5 Primary Logon ID: %6
Client User Name: %7 Client Domain: %8
Client Logon ID: %9 Privileges: %10
Event ID: 592 (0x0250)
Type: Success Audit
Description: A new process has been created
New Process ID: %1 Image File Name: %2
Creator Process ID: %3 User Name: %4
Domain: %5 Logon ID: %6
Event ID: 593 (0x0251)
Type: Success Audit
Description: A process has exited
Process ID: %1 User Name: %2
Domain: %3 Logon ID: %4
Event ID: 594 (0x0252)
Type: Success Audit
Description: A handle to an object has been duplicated
Source Handle ID: %1 Source Process ID: %2
Target Handle ID: %3 Target Process ID: %4
Event ID: 595 (0x0253)
Type: Success Audit
Description: Indirect access to an object has been obtained
Object Type: %1 Object Name: %2
Process ID: %3 Primary User Name: %4
Primary Domain: %5 Primary Logon ID: %6
Client User Name: %7 Client Domain: %8
Client Logon ID: %9 Accesses: %10
Event ID: 608 (0x0260)
Type: Success Audit
Description: User Right Assigned
User Right: %1 Assigned To: %2
Assigned By User Name: %3 Domain: %4
Logon ID: %5
Event ID: 609 (0x0261)
Type: Success Audit
Description: User Right Removed
User Right: %1 Removed From: %2
Removed By: User Name: %3 Domain: %4
Logon ID: %5
Event ID: 610 (0x0262)
Type: Success Audit
Description: New Trusted Domain
Domain Name: %1 Domain ID: %2
Established By:
User Name: %3 Domain: %4
Logon ID: %5
Event ID: 611 (0x0263)
Type: Success Audit
Description: Removing Trusted Domain
Domain Name: %1 Domain ID: %2
Removed By: User Name: %3 Domain: %4
Logon ID: %5
Event ID: 612 (0x0264)
Type: Success Audit
Description: Audit Policy Change
New Policy:
Success Failure
%1 %2 System
%3 %4 Logon/Logoff
%5 %6 Object Access
%7 %8 Privilege Use
%9 %10 Detailed Tracking
%11 %12 Policy Change
%13 %14 Account Management
Changed By:
User Name: %15 Domain Name: %16
Logon ID: %17
Event ID: 613 (0x0265)
Type: Success Audit
Description: IPSec policy agent started
Ipsec Policy Agent: %1 Policy Source: %2
Event Data: %3
Event ID: 614 (0x0266)
Type: Success Audit
Description: IPSec policy agent disabled
Ipsec Policy Agent: %1 Event Data: %2
Event ID: 615 (0x0267)
Type: Success Audit
Description: IPSEC PolicyAgent Service: %1
Event Data: %1
Event ID: 616 (0x0268)
Type: Failure Audit
Description: IPSec policy agent encountered a potentially serious failure.
Event Data: %1
Event ID: 617 (0x0269)
Type: Success Audit
Description: Kerberos Policy Changed
Changed By: User Name: %1 Domain Name: %2
Logon ID: %3
Changes made: %4
'-' means no changes, otherwise each change is shown as:
Parameter Name: (new value) (old value)
Event ID: 618 (0x026a)
Type: Success Audit
Description: Encrypted Data Recovery Policy Changed
Changed By: User Name: %1 Domain Name: %2
Logon ID: %3
Changes made: %4
'-' means no changes, otherwise each change is shown as:
Parameter Name: new value (old value)
Event ID: 619 (0x026b)
Type: Success Audit
Description: Quality of Service Policy Changed
Changed By: User Name: %1 Domain Name: %2
Logon ID: %3
Changes made: %4
'-' means no changes, otherwise each change is shown as:
Parameter Name: new value (old value)
Event ID: 620 (0x026C)
Description: Trusted Domain Information Modified:
Domain Name: %1 Domain ID: %2
Modified By: User Name: %3 Domain: %4
Logon ID: %5
Event ID: 624 (0x0270)
Type: Success Audit
Description: User Account Created
New Account Name: %1 New Domain: %2
New Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges %7
Event ID: 625 (0x0271)
Description: User Account Type Change
Type: Success Audit
Target Account Name: %1 Target Domain: %2
Target Account ID: %3
New Type: %4 Caller User Name: %5
Caller Domain: %6 Caller Logon ID: %7
Event ID: 626 (0x0272)
Description: User Account Enabled
Type: Success Audit
Target Account Name: %1 Target Domain: %2
Target Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6
Note: Windows 2000 does not log event ID 626 explicitly.
Results are logged as a part of event ID 642 in the description of the message.
Event ID: 627 (0x0273)
Type: Success Audit
Description: Change Password Attempt
Target Account Name: %1 Target Domain: %2
Target Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 628 (0x0274)
Type: Success Audit
Description: User Account password set
Target Account Name: %1 Target Domain: %2
Target Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6
Event ID: 630 (0x0276)
Type: Success Audit
Description: User Account Deleted:
Target Account Name: %1 Target Domain: %2
Target Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 631 (0x0277)
Type: Success Audit
Description: Security Enabled Global Group Created
New Account Name: %1 New Domain: %2
New Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 632 (0x0278)
Type: Success Audit
Description: Security Enabled Global Group Member Added
Member Name: %1 Member ID: %2
Target Account Name: %3 Target Domain: %4
Target Account ID: %5
Caller User Name: %6 Caller Domain: %7
Caller Logon ID: %8 Privileges: %9
Event ID: 633 (0x0279)
Type: Success Audit
Description: Security Enabled Global Group Member Removed
Member Name: %1 Member ID: %2
Target Account Name: %3 Target Domain: %4
Target Account ID: %5
Caller User Name: %6 Caller Domain: %7
Caller Logon ID: %8 Privileges: %9
Event ID: 634 (0x027A)
Type: Success Audit
Description: Security Enabled Global Group Deleted
Target Account Name: %1 Target Domain: %2
Target Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 635 (0x027B)
Type: Success Audit
Description: Security Enabled Local Group Created
New Account Name: %1 New Domain: %2
New Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 636 (0x027C)
Type: Success Audit
Description: Security Enabled Local Group Member Added
Member Name: %1 Member ID: %2
Target Account Name: %3 Target Domain: %4
Target Account ID: %5
Caller User Name: %6 Caller Domain: %7
Caller Logon ID: %8 Privileges: %9
Event ID: 637 (0x027D)
Type: Success Audit
Description: Security Enabled Local Group Member Removed
Member Name: %1 Member ID: %2
Target Account Name: %3 Target Domain: %4
Target Account ID: %5
Caller User Name: %6 Caller Domain: %7
Caller Logon ID: %8 Privileges: %9
Event ID: 638 (0x027E)
Type: Success Audit
Description: Security Enabled Local Group Deleted
Target Account Name: %1 Target Domain: %2
Target Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 639 (0x027F)
Type: Success Audit
Description: Security Enabled Local Group Changed
Target Account Name: %1 Target Domain: %2
Target Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 640 (0x0280)
Type: Success Audit
Description: General Account Database Change
Type of change: %1 Object Type: %2
Object Name: %3 Object ID: %4
Caller User Name: %5 Caller Domain: %6
Caller Logon ID: %7
Event ID: 641 (0x0281)
Type: Success Audit
Description: Security Enabled Global Group Changed
Target Account Name: %1 Target Domain: %2
Target Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 642 (0x0282)
Type: Success Audit
Description: User Account Changed
Target Account Name: %1 Target Domain: %2
Target Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 643 (0x0283)
Type: Success Audit
Description: Domain Policy Changed: %1 modified
Domain: %2 Domain ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 644 (0x0284)
Type: Success Audit
Description: User Account Locked Out
Target Account Name: %1 Target Account ID: %3
Caller Machine Name: %2
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6
Event ID: 645 (0x0285)
Type: Success Audit
Description: Computer Account Created
New Account Name: %1 New Domain: %2
New Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges %7
Event ID: 646 (0x0286)
Type: Success Audit
Description: Computer Account Changed
Target Account Name: %1 Target Domain: %2
Target Account ID: %3
Caller User Name: %5 Caller Domain: %6
Caller Logon ID: %7 Privileges: %8
Event ID: 647 (0x0287)
Type: Success Audit
Description: Computer Account Deleted
Target Account Name: %1 Target Domain: %2
Target Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 648 (0x0288)
Type: Success Audit
Description: Security Disabled Local Group Created
Target Account Name: %1 Target Domain: %2
Target Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 649 (0x0289)
Type: Success Audit
Description: Security Disabled Local Group Changed
Target Account Name: %1 Target Domain: %2
Target Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 650 (0x028A)
Type: Success Audit
Description: Security Disabled Local Group Member Added
Member Name: %1 Member ID: %2
Target Account Name: %3 Target Domain: %4
Target Account ID: %5
Caller User Name: %6 Caller Domain: %7
Caller Logon ID: %8 Privileges: %9
Event ID: 651 (0x028B)
Type: Success Audit
Description: Security Disabled Local Group Member Removed
Member Name: %1 Member ID: %2
Target Account Name: %3 Target Domain: %4
Target Account ID: %5
Caller User Name: %6 Caller Domain: %7
Caller Logon ID: %8 Privileges: %9
Event ID: 652 (0x028C)
Type: Success Audit
Description: Security Disabled Local Group Deleted
Target Account Name: %1 Target Domain: %2
Target Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 653 (0x028D)
Type: Success Audit
Description: Security Disabled Global Group Created
New Account Name: %1 New Domain: %2
New Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 654 (0x028E)
Type: Success Audit
Description: Security Disabled Global Group Changed
Target Account Name: %1 Target Domain: %2
Target Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 655 (0x028F)
Type: Success Audit
Description: Security Disabled Global Group Member Added
Member Name: %1 Member ID: %2
Target Account Name: %3 Target Domain: %4
Target Account ID: %5
Caller User Name: %6 Caller Domain: %7
Caller Logon ID: %8 Privileges: %9
Event ID: 656 (0x0290)
Type: Success Audit
Description: Security Disabled Global Group Member Removed
Member Name: %1 Member ID: %2
Target Account Name: %3 Target Domain: %4
Target Account ID: %5
Caller User Name: %6 Caller Domain: %7
Caller Logon ID: %8 Privileges: %9
Event ID: 657 (0x0291)
Type: Success Audit
Description: Security Disabled Global Group Deleted
Target Account Name: %1 Target Domain: %2
Target Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 658 (0x0292)
Type: Success Audit
Description: Security Enabled Universal Group Created
New Account Name: %1 New Domain: %2
New Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 659 (0x0293)
Type: Success Audit
Description: Security Enabled Universal Group Changed
Target Account Name: %1 Target Domain: %2
Target Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 660 (0x0294)
Type: Success Audit
Description: Security Enabled Universal Group Member Added
Member Name: %1 Member ID: %2
Target Account Name: %3 Target Domain: %4
Target Account ID: %5
Caller User Name: %6 Caller Domain: %7
Caller Logon ID: %8 Privileges: %9
Event ID: 661 (0x0295)
Type: Success Audit
Description: Security Enabled Universal Group Member Removed
Member Name: %1 Member ID: %2
Target Account Name: %3 Target Domain: %4
Target Account ID: %5
Caller User Name: %6 Caller Domain: %7
Caller Logon ID: %8 Privileges: %9
Event ID: 662 (0x0296)
Type: Success Audit
Description: Security Enabled Universal Group Deleted
Target Account Name: %1 Target Domain: %2
Target Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 663 (0x0297)
Type: Success Audit
Description: Security Disabled Universal Group Created
New Account Name: %1 New Domain: %2
New Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 664 (0x0298)
Type: Success Audit
Description: Security Disabled Universal Group Changed
Target Account Name: %1 Target Domain: %2
Target Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 665 (0x0299)
Type: Success Audit
Description: Security Disabled Universal Group Member Added
Member Name: %1 Member ID: %2
Target Account Name: %3 Target Domain: %4
Target Account ID: %5
Caller User Name: %6 Caller Domain: %7
Caller Logon ID: %8 Privileges: %9
Event ID: 666 (0x029A)
Type: Success Audit
Description: Security Disabled Universal Group Member Removed
Member Name: %1 Member ID: %2
Target Account Name: %3 Target Domain: %4
Target Account ID: %5
Caller User Name: %6 Caller Domain: %7
Caller Logon ID: %8 Privileges: %9
Event ID: 667 (0x029B)
Type: Success Audit
Description: Security Disabled Universal Group Deleted
Target Account Name: %1 Target Domain: %2
Target Account ID: %3
Caller User Name: %4 Caller Domain: %5
Caller Logon ID: %6 Privileges: %7
Event ID: 668 (0x029C)
Type: Success Audit
Description: Group Type Changed
Target Account Name: %1 Target Domain: %2
Target Account ID: %3
Caller User Name: %5 Caller Domain: %6
Caller Logon ID: %7 Privileges: %8
Event ID: 669 (0x029D)
Type: Success Audit
Description: Add SID History
Source Account Name: %1 Source Account ID: %2
Target Account Name: %3 Target Domain: %4
Target Account ID: %5
Caller User Name: %6 Caller Domain: %7
Caller Logon ID: %8 Privileges: %9
Event ID: 670 (0x029E)
Type: Success Audit
Description: Add SID History
Source Account Name: %1 Target Account Name: %2
Target Domain: %3 Target Account ID: %4
Caller User Name: %5 Caller Domain: %6
Caller Logon ID: %7 Privileges: %8
Event ID: 672 (0x02a0)
Type: Success Audit
Description: Authentication Ticket Granted
User Name: %1 Supplied Realm Name: %2
User ID: %3 Service Name: %4
Service ID: %5 Ticket Options: %6
Ticket Encryption Type: %7 Pre-Authentication Type: %8
Client Address: %9
Event ID: 673 (0x02a1)
Type: Success Audit
Description: Service Ticket Granted
User Name: %1 User Domain: %2
Service Name: %3 Service ID: %4
Ticket Options: %5 Ticket Encryption Type: %6
Client Address: %7
Event ID: 674 (0x02a2)
Type: Success Audit
Description: Ticket Granted Renewed
User Name: %1 User Domain: %2
Service Name: %3 Service ID: %4
Ticket Options: %5 Ticket Encryption Type: %6
Client Address: %7
Event ID: 675 (0x02a3)
Type: Failure Audit
Description: Pre-authentication failed
User Name: %1 User ID: %2
Service Name: %3 Pre-Authentication Type: %4
Failure Code: %5 Client Address: %6
Event ID: 676 (0x02a4)
Type: Failure Audit
Description: Authentication Ticket Request Failed
User Name: %1 Supplied Realm Name: %2
Service Name: %3 Ticket Options: %4
Failure Code: %5 Client Address: %6
Event ID: 677 (0x02a5)
Type: Failure Audit
Description: Service Ticket Request Failed:
Description: Authentication Ticket Request Failed
User Name: %1 Supplied Realm Name: %2
Service Name: %3 Ticket Options: %4
Failure Code: %5 Client Address: %6
Event ID: 678 (0x02a6)
Type: Success Audit
Description: Account Mapped for Logon by: %1
Client Name: %2 Mapped Name:%3
Event ID: 679 (0x02a7)
Type: Failure Audit
Description: The name: %2 could not be mapped for logon by: %1
Event ID: 680 (0x02a8)
Type: Success Audit
Description: Account Used for Logon by: %1
Account Name: %2 Workstation: %3
Event ID: 681 (0x02a9)
Type: Failure Audit
Description: The logon to account: %2 by: %1 from workstation: %3 failed. The error code was: %4
Event ID: 682 (0x02aa)
Type: Success Audit
Description: Session reconnected to winstation:
User Name: %1 Domain: %2
Logon ID: %3 Session Name: %4
Client Name: %5 Client Address: %6
Event ID: 683 (0x02ab)
Type: Success Audit
Description: Session disconnected from winstation:
User Name: %1 Domain: %2
Logon ID: %3 Session Name: %4
Client Name: %5 Client Address: %6
