Windows events for auditing logon issues

10/10/2014 admin News, Windows

Event Id	Event Type	Event Occured	Reason
529	Failure Audit	Logon Failure	Unknown user name or bad Password
539	Failure Audit	Logon Failure	The user trying to logon is already locked
612	Policy Change	Policy Changed	General Audit Policy changed
643	Policy Change	Domain Policy Changed	Changes in Account Lockout and Password policis
644	Success Audit	User Account Locked Out	The user account has reached the account lockout threshold
671	Success Audit	User Account Unlocked	User Account Unlocked
675	Failure Audit	Logon Failure	Pre-authentication failed

 

Event Id	Event Type	Event Occured	Reason
4625	Failure Audit	Logon Failure	Unknown user name or bad Password
4719	Policy Change	Policy Changed	General Audit Policy changed
4739	Policy Change	Domain Policy Changed	Changes in Account Lockout and Password policis
4740	Success Audit	User Account Locked Out	The user account has reached the account lockout threshold
4767	Success Audit	User Account Unlocked	User Account Unlocked
4771	Failure Audit	Logon Failure	Kerberos Pre-authentication failed

Exchange + export e-mail for specific time interval Exchange 2010 + Outlook + New feature: Room Finder