> For the complete documentation index, see [llms.txt](https://windows.dfirhandbook.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://windows.dfirhandbook.com/windows-artifacts/event-ids.md).

# Event IDs

- [Security](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security.md)
- [Authentication / Account](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/authentication-account.md)
- [4624 - Authentication Success](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/authentication-account/4624-authentication-success.md): https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624
- [Logon Types](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/authentication-account/4624-authentication-success/logon-types.md)
- [4625 - Authentication Failure](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/authentication-account/4625-authentication-failure.md): https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625
- [SubStatus Codes](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/authentication-account/4625-authentication-failure/substatus-codes.md)
- [4634 - Account Logoff](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/authentication-account/4634-account-logoff.md): https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4634
- [4648 - Explicit Credentials Success](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/authentication-account/4648-explicit-credentials-success.md): https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648
- [4672 - Special Privileges](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/authentication-account/4672-special-privileges.md): https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4672
- [4720 - Account Creation](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/authentication-account/4720-account-creation.md): https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4720
- [4722 - Account Enabled](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/authentication-account/4722-account-enabled.md): https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4722
- [4732 - Addition to Local Group](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/authentication-account/4732-addition-to-local-group.md): https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4732
- [4738 - Account Changed](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/authentication-account/4738-account-changed.md): https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4738
- [4776 - Kerberos Authentication Attempt](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/authentication-account/4776-kerberos-authentication-attempt.md): https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776
- [Substatus Codes](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/authentication-account/4776-kerberos-authentication-attempt/substatus-codes.md)
- [4771 - Kerberos Failure](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/authentication-account/4771-kerberos-failure.md): https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4771
- [4768](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/authentication-account/4768.md)
- [File System](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/file-system.md)
- [1006](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/file-system/1006.md)
- [4688 - Process Created](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/file-system/4688-process-created.md): https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4688
- [4663](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/file-system/4663.md)
- [4656](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/file-system/4656.md)
- [6416](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/file-system/6416.md)
- [20001](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/file-system/20001.md)
- [20003](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/file-system/20003.md)