Windows Event ID lookup

Curated Intune, Autopilot, Entra join, Kerberos, and NTLM IDs. Not every event in the OS.

ID	Title	Log / source	Notes
4624	Successful logon	Security	Type 2 interactive, 3 network, 10 RDP.
4625	Failed logon	Security	Status/substatus explain bad password vs unknown user.
4634	Logoff	Security	Pairs with 4624.
4648	Logon with explicit credentials	Security	RunAs / mapped drives / some lateral movement.
4672	Special privileges assigned	Security	Admin logon indicator.
4688	Process created	Security	Needs process tracking audit.
4698	Scheduled task created	Security	Persistence.
4720	User account created	Security	SAM / AD.
4728	Member added to global group	Security	Privilege change.
4732	Member added to local group	Security	Local Administrators is the hot one.
4740	Account locked out	Security	Often password spray or stale service creds.
4768	Kerberos TGT requested	Security	AS-REQ.
4769	Kerberos service ticket requested	Security	TGS. RC4 can be a smell.
4771	Kerberos pre-auth failed	Security	Bad password against KRBTGT path.
4776	NTLM credential validation	Security	NTLM, not Kerberos.
5140	Network share accessed	Security	SMB share.
7045	Service installed	System	Service persistence.
1102	Audit log cleared	Security	High signal.
1116	Malware detected	Microsoft-Windows-Windows Defender	Defender.
500	MDM / Intune diagnostics	Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider	Enrollment and sync noise lives here.
209	Intune MDM session	Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider	Check for enrollment errors nearby.
404	Autopilot diagnostics	Microsoft-Windows-Provisioning-Diagnostics-Provider/AutoPilot	ESP / profile assignment clues.
307	Device registration	Microsoft-Windows-User Device Registration	Hybrid/Entra join.
304	Device registration failure	Microsoft-Windows-User Device Registration	Join failed.
108	AAD / PRT related	Microsoft-Windows-AAD	CloudAP / PRT issues.
1098	AAD token / broker	Microsoft-Windows-AAD	WAM / broker errors nearby.
1006	Network connectivity	Microsoft-Windows-NCSI	Captive portal / no internet during Autopilot.

← All tools

Windows Event ID lookup

Curated Intune, Autopilot, Entra join, Kerberos, and NTLM IDs. Not every event in the OS.

ID	Title	Log / source	Notes
4624	Successful logon	Security	Type 2 interactive, 3 network, 10 RDP.
4625	Failed logon	Security	Status/substatus explain bad password vs unknown user.
4634	Logoff	Security	Pairs with 4624.
4648	Logon with explicit credentials	Security	RunAs / mapped drives / some lateral movement.
4672	Special privileges assigned	Security	Admin logon indicator.
4688	Process created	Security	Needs process tracking audit.
4698	Scheduled task created	Security	Persistence.
4720	User account created	Security	SAM / AD.
4728	Member added to global group	Security	Privilege change.
4732	Member added to local group	Security	Local Administrators is the hot one.
4740	Account locked out	Security	Often password spray or stale service creds.
4768	Kerberos TGT requested	Security	AS-REQ.
4769	Kerberos service ticket requested	Security	TGS. RC4 can be a smell.
4771	Kerberos pre-auth failed	Security	Bad password against KRBTGT path.
4776	NTLM credential validation	Security	NTLM, not Kerberos.
5140	Network share accessed	Security	SMB share.
7045	Service installed	System	Service persistence.
1102	Audit log cleared	Security	High signal.
1116	Malware detected	Microsoft-Windows-Windows Defender	Defender.
500	MDM / Intune diagnostics	Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider	Enrollment and sync noise lives here.
209	Intune MDM session	Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider	Check for enrollment errors nearby.
404	Autopilot diagnostics	Microsoft-Windows-Provisioning-Diagnostics-Provider/AutoPilot	ESP / profile assignment clues.
307	Device registration	Microsoft-Windows-User Device Registration	Hybrid/Entra join.
304	Device registration failure	Microsoft-Windows-User Device Registration	Join failed.
108	AAD / PRT related	Microsoft-Windows-AAD	CloudAP / PRT issues.
1098	AAD token / broker	Microsoft-Windows-AAD	WAM / broker errors nearby.
1006	Network connectivity	Microsoft-Windows-NCSI	Captive portal / no internet during Autopilot.