> For the complete documentation index, see [llms.txt](https://windows.dfirhandbook.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/authentication-account.md).

# Authentication / Account

- [4624 - Authentication Success](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/authentication-account/4624-authentication-success.md): https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624
- [Logon Types](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/authentication-account/4624-authentication-success/logon-types.md)
- [4625 - Authentication Failure](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/authentication-account/4625-authentication-failure.md): https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625
- [SubStatus Codes](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/authentication-account/4625-authentication-failure/substatus-codes.md)
- [4634 - Account Logoff](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/authentication-account/4634-account-logoff.md): https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4634
- [4648 - Explicit Credentials Success](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/authentication-account/4648-explicit-credentials-success.md): https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648
- [4672 - Special Privileges](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/authentication-account/4672-special-privileges.md): https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4672
- [4720 - Account Creation](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/authentication-account/4720-account-creation.md): https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4720
- [4722 - Account Enabled](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/authentication-account/4722-account-enabled.md): https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4722
- [4732 - Addition to Local Group](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/authentication-account/4732-addition-to-local-group.md): https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4732
- [4738 - Account Changed](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/authentication-account/4738-account-changed.md): https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4738
- [4776 - Kerberos Authentication Attempt](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/authentication-account/4776-kerberos-authentication-attempt.md): https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776
- [Substatus Codes](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/authentication-account/4776-kerberos-authentication-attempt/substatus-codes.md)
- [4771 - Kerberos Failure](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/authentication-account/4771-kerberos-failure.md): https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4771
- [4768](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/authentication-account/4768.md)