Security Event Descriptions (174074)


The information in this article applies to:

  • Microsoft Windows NT Workstation 3.5
  • Microsoft Windows NT Workstation 3.51
  • Microsoft Windows NT Workstation 4.0
  • Microsoft Windows NT Server 3.5
  • Microsoft Windows NT Server 3.51
  • Microsoft Windows NT Server 4.0
This article was previously published under Q174074

SUMMARY

This article contains descriptions of various security-related and auditing- related events, and tips for interpreting them.

These events will all appear in the Security event log and will be logged with a source of "Security."

MORE INFORMATION

   Event ID: 512
       Type: Success Audit
Description: Windows NT is starting up.

   Event ID: 513
       Type: Success Audit
Description: Windows NT is shutting down. All logon sessions will be
             terminated by this shutdown.

   Event ID: 514
       Type: Success Audit
Description: An authentication package has been loaded by the Local
             Security Authority. This authentication package will be
             used to authenticate logon attempts.
             Authentication Package Name: %1

   Event ID: 515
       Type: Success Audit
Description: A trusted logon process has registered with the Local
             Security Authority. This logon process will be trusted to
             submit logon requests.
             Logon Process Name: %1

   Event ID: 516
       Type: Success Audit
Description: Internal resources allocated for the queuing of audit
             messages have been exhausted, leading to the loss of some
             audits.
             Number of audit messages discarded: %1

   Event ID: 517
       Type: Success Audit
Description: The audit log was cleared
             Primary User Name: %1      Primary Domain: %2
             Primary Logon ID: %3       Client User Name: %4
             Client Domain: %5          Client Logon ID: %6

   Event ID: 518
       Type: Success Audit
Description: A notification package has been loaded by the Security
             Account Manager. This package will be notified of any
             account or password changes.
             Notification Package Name: %1

   Event ID: 528
       Type: Success Audit
Description: Successful Logon:
             User Name: %1             Domain: %2
             Logon ID: %3              Logon Type: %4
             Logon Process: %5         Authentication Package: %6
             Workstation Name: %7

   Event ID: 529
       Type: Failure Audit
Description: Logon Failure:
             Reason: Unknown user name or bad password
             User Name: %1              Domain: %2
             Logon Type: %3             Logon Process: %4
             Authentication Package: %5 Workstation Name: %6

   Event ID: 530
       Type: Failure Audit
Description: Logon Failure:
             Reason: Account logon time restriction violation
             User Name: %1              Domain: %2
             Logon Type: %3             Logon Process: %4
             Authentication Package: %5 Workstation Name: %6

   Event ID: 531
       Type: Failure Audit
Description: Logon Failure:
             Reason: Account currently disabled
             User Name: %1              Domain: %2
             Logon Type: %3             Logon Process: %4
             Authentication Package: %5 Workstation Name: %6

   Event ID: 532
       Type: Failure Audit
Description: Logon Failure:
             Reason: The specified user account has expired
             User Name: %1              Domain: %2
             Logon Type: %3             Logon Process: %4
             Authentication Package: %5 Workstation Name: %6

   Event ID: 533
       Type: Failure Audit
Description: Logon Failure:
             Reason: User not allowed to logon at this computer
             User Name: %1              Domain: %2
             Logon Type: %3             Logon Process: %4
             Authentication Package: %5 Workstation Name: %6

   Event ID: 534
       Type: Failure Audit
Description: Logon Failure:
             Reason: The user has not been granted the requested logon
             type at this machine
             User Name: %1              Domain: %2
             Logon Type: %3             Logon Process: %4
             Authentication Package: %5 Workstation Name: %6

   Event ID: 535
       Type: Failure Audit
Description: Logon Failure:
             Reason: The specified account's password has expired
             User Name: %1              Domain: %2
             Logon Type: %3             Logon Process: %4
             Authentication Package: %5 Workstation Name: %6


   Event ID: 536
       Type: Failure Audit
Description: Logon Failure:
             Reason: The NetLogon component is not active
             User Name: %1              Domain: %2
             Logon Type: %3             Logon Process: %4
             Authentication Package: %5 Workstation Name: %6

   Event ID: 537
       Type: Failure Audit
Description: Logon Failure:
             Reason: An unexpected error occurred during logon
             User Name: %1              Domain: %2
             Logon Type: %3             Logon Process: %4
             Authentication Package: %5 Workstation Name: %6


   Event ID: 538
       Type: Success Audit
Description: User Logoff:
             User Name: %1             Domain: %2
             Logon ID: %3              Logon Type: %4

   Event ID: 539
       Type: Failure Audit
Description: Logon Failure:
             Reason: Account locked out
             User Name: %1              Domain: %2
             Logon Type: %3             Logon Process: %4
             Authentication Package: %5 Workstation Name: %6

   Event ID: 560
       Type: Success Audit
Description: Object Open:
             Object Server: %1          Object Type: %2
             Object Name: %3            New Handle ID: %4
             Operation ID: {%5,%6}
             Process ID: %7             Primary User Name: %8
             Primary Domain: %9         Primary Logon ID: %10
             Client User Name: %11      Client Domain: %12
             Client Logon ID: %13       Accesses %14
             Privileges %15

   Event ID: 561
       Type: Success Audit
Description: Handle Allocated:
             Handle ID: %1              Operation ID: {%2,%3}
             Process ID: %4

   Event ID: 562
       Type: Success Audit
Description: Handle Closed:
             Object Server: %1          Handle ID: %2
             Process ID: %3

   Event ID: 563
       Type: Success Audit
Description: Object Open for Delete:
             Object Server: %1          Object   Type: %2
             Object Name: %3            New Handle ID: %4
             Operation ID: {%5,%6}
             Process ID: %7             Primary User Name: %8
             Primary Domain: %9         Primary Logon ID: %10
             Client User Name: %11      Client Domain: %12
             Client Logon ID: %13       Accesses %14
             Privileges %15

   Event ID: 564
       Type: Success Audit
Description: Object Deleted:
             Object Server: %1          Handle ID: %2
             Process ID: %3

   Event ID: 576
       Type: Success Audit
Description: Special privileges assigned to new logon:
             User Name: %1             Domain: %2
             Logon ID: %3              Assigned: %4

   Event ID: 577
       Type: Success Audit
Description: Privileged Service Called:
             Server: %1              Service: %2
             Primary User Name: %3      Primary Domain: %4
             Primary Logon ID: %5       Client User Name: %6
             Client Domain: %7          Client Logon ID: %8
             Privileges: %9

   Event ID: 578
       Type: Failure Audit
Description: Privileged object operation:
             Object Server: %1          Object Handle: %2
             Process ID: %3             Primary User Name: %4
             Primary Domain: %5         Primary Logon ID: %6
             Client User Name: %7       Client Domain: %8
             Client Logon ID: %9        Privileges: %10

   Event ID: 592
       Type: Success Audit
Description: A new process has been created:
             New Process ID: %1         Image File Name: %2
             Creator Process ID: %3     User Name: %4
             Domain: %5                 Logon ID: %6

   Event ID: 593
       Type: Success Audit
Description: A process has exited:
             Process ID: %1             User Name: %2
             Domain: %3              Logon ID: %4

   Event ID: 594
       Type: Success Audit
Description: A handle to an object has been duplicated:
             Source Handle ID: %1       Source Process ID: %2
             Target Handle ID: %3       Target Process ID: %4

   Event ID: 595
       Type: Success Audit
Description: Indirect access to an object has been obtained:
             Object   Type: %1          Object Name: %2
             Process ID: %3             Primary User Name: %4
             Primary Domain: %5         Primary Logon ID: %6
             Client User Name: %7       Client Domain: %8
             Client Logon ID: %9        Accesses: %10

   Event ID: 608
       Type: Success Audit
Description: User Right Assigned:
             User Right: %1             Assigned To: %2
             Assigned By:
             User Name: %3              Domain: %4
             Logon ID: %5

   Event ID: 609
       Type: Success Audit
Description: User Right Removed:
             User Right: %1             Removed From: %2
             Removed By:
             User Name: %3              Domain: %4
             Logon ID: %5

   Event ID: 610
       Type: Success Audit
Description: New Trusted Domain:
             Domain Name: %1            Domain ID: %2
             Established By:
             User Name: %3              Domain: %4
             Logon ID: %5

   Event ID: 611
       Type: Success Audit
Description: Removing Trusted Domain:
             Domain Name: %1            Domain ID: %2
             Removed By:
             User Name: %3              Domain: %4
             Logon ID: %5

   Event ID: 612
       Type: Success Audit
Description: Audit Policy Change:
             New Policy:
             Success   Failure
               %1         %2    System
               %3         %4    Logon/Logoff
               %5         %6    Object Access
               %7         %8    Privilege Use
               %9        %10    Detailed Tracking
              %11        %12    Policy Change
              %13        %14    Account Management
             Changed By:
             User Name: %15             Domain Name: %16
             Logon ID: %17

   Event ID: 624
       Type: Success Audit
Description: User Account Created:
             New Account Name: %1       New Domain: %2
             New Account ID: %3         Caller User Name: %4
             Caller Domain: %5          Caller Logon ID: %6
             Privileges %7

   Event ID: 625
       Type: Success Audit
Description: User Account Type Change:
             Target Account Name: %1    Target Domain: %2
             Target Account ID: %3      New Type: %4
             Caller User Name: %5       Caller Domain: %6
             Caller Logon ID: %7

   Event ID: 626
       Type: Success Audit
Description: User Account Enabled:
             Target Account Name: %1    Target Domain: %2
             Target Account ID: %3      Caller User Name: %4
             Caller Domain: %5          Caller Logon ID: %6

   Event ID: 627
       Type: Success Audit
Description: Change Password Attempt:
             Target Account Name: %1    Target Domain: %2
             Target Account ID: %3      Caller User Name: %4
             Caller Domain: %5          Caller Logon ID: %6
             Privileges: %7

   Event ID: 628
       Type: Success Audit
Description: User Account password set:
             Target Account Name: %1    Target Domain: %2
             Target Account ID: %3      Caller User Name: %4
             Caller Domain: %5          Caller Logon ID: %6

   Event ID: 629
       Type: Success Audit
Description: User Account Disabled:
             Target Account Name: %1    Target Domain: %2
             Target Account ID: %3      Caller User Name: %4
             Caller Domain: %5          Caller Logon ID: %6

   Event ID: 630
       Type: Success Audit
Description: User Account Deleted:
             Target Account Name: %1    Target Domain: %2
             Target Account ID: %3      Caller User Name: %4
             Caller Domain: %5          Caller Logon ID: %6
             Privileges: %7

   Event ID: 631
       Type: Success Audit
Description: Global Group Created:
             New Account Name: %1       New Domain: %2
             New Account ID: %3         Caller User Name: %4
             Caller Domain: %5          Caller Logon ID: %6
             Privileges: %7

   Event ID: 632
       Type: Success Audit
Description: Global Group Member Added:
             Member: %1                 Target Account Name: %2
             Target Domain: %3          Target Account ID: %4
             Caller User Name: %5       Caller Domain: %6
             Caller Logon ID: %7        Privileges: %8

   Event ID: 633
       Type: Success Audit
Description: Global Group Member Removed:
             Member: %1                 Target Account Name: %2
             Target Domain: %3          Target Account ID: %4
             Caller User Name: %5       Caller Domain: %6
             Caller Logon ID: %7        Privileges: %8

   Event ID: 634
       Type: Success Audit
Description: Global Group Deleted:
             Target Account Name: %1    Target Domain: %2
             Target Account ID: %3      Caller User Name: %4
             Caller Domain: %5          Caller Logon ID: %6
             Privileges: %7

   Event ID: 635
       Type: Success Audit
Description: Local Group Created:
             New Account Name: %1       New Domain: %2
             New Account ID: %3         Caller User Name: %4
             Caller Domain: %5          Caller Logon ID: %6
             Privileges: %7

   Event ID: 636
       Type: Success Audit
Description: Local Group Member Added:
             Member: %1                 Target Account Name: %2
             Target Domain: %3          Target Account ID: %4
             Caller User Name: %5       Caller Domain: %6
             Caller Logon ID: %7        Privileges: %8

   Event ID: 637
       Type: Success Audit
Description: Local Group Member Removed:
             Member: %1                 Target Account Name: %2
             Target Domain: %3          Target Account ID: %4
             Caller User Name: %5       Caller Domain: %6
             Caller Logon ID: %7        Privileges: %8

   Event ID: 638
       Type: Success Audit
Description: Local Group Deleted:
             Target Account Name: %1    Target Domain: %2
             Target Account ID: %3      Caller User Name: %4
             Caller Domain: %5          Caller Logon ID: %6
             Privileges: %7

   Event ID: 639
       Type: Success Audit
Description: Local Group Changed:
             Target Account Name: %1    Target Domain: %2
             Target Account ID: %3      Caller User Name: %4
             Caller Domain: %5          Caller Logon ID: %6
             Privileges: %7

   Event ID: 640
       Type: Success Audit
Description: General Account Database Change:
             Type of change: %1         Object Type: %2
             Object Name: %3            Object ID: %4
             Caller User Name: %5       Caller Domain: %6
             Caller Logon ID: %7

   Event ID: 641
       Type: Success Audit
Description: Global Group Changed:
             Target Account Name: %1    Target Domain: %2
             Target Account ID: %3      Caller User Name: %4
             Caller Domain: %5          Caller Logon ID: %6
             Privileges: %7

   Event ID: 642
       Type: Success Audit
Description: User Account Changed:
             Target Account Name: %1    Target Domain: %2
             Target Account ID: %3      Caller User Name: %4
             Caller Domain: %5          Caller Logon ID: %6
             Privileges: %7

   Event ID: 643
       Type: Success Audit
Description: Domain Policy Changed:
             Domain: %1                 Domain ID: %2
             Caller User Name: %3       Caller Domain: %4
             Caller Logon ID: %5        Privileges: %6

   Event ID: 644
 Event Type: Success Audit
Description: User Account Locked Out
Target Account Name:  %1   Target Account ID: %2
Caller Machine Name:  %3    Caller User Name:  %4
Caller Domain:      %5        Caller Logon ID:  %6
Modification Type:MajorLast Reviewed:5/13/2003
Keywords:kbinfo KB174074
©2002 Microsoft Corporation. All rights reserved.