A Windows Event ID is a numeric code that identifies a specific type of event recorded in Windows Event Viewer. Each Event ID corresponds to a particular action, error, warning, or information message generated by Windows or an application.
In simple terms
👉 Event ID = a label number that tells you exactly what happened
1. Event ID 4624 – Successful Logon
Category: Security
Meaning: A user successfully logged on to the system.
Key Details:
- Indicates who logged in, from where, and how
- Logon types show the method:
2– Interactive (keyboard)3– Network (file share, remote access)10– Remote Desktop (RDP)
Why it matters:
- Used to track legitimate access
- Helps detect unauthorized access patterns
2. Event ID 4625 – Failed Logon Attempt
Category: Security
Meaning: A login attempt failed.
Key Details:
- Includes failure reason (wrong password, disabled account, etc.)
- Shows source IP address
- Common status codes:
0xC000006A– Wrong password0xC0000064– User does not exist
Why it matters:
- Key indicator of brute-force attacks
- Repeated failures from one IP are suspicious
3. Event ID 4634 – Logoff
Category: Security
Meaning: A user logged off.
Key Details:
- Matches a previous 4624 event
- Helps calculate session duration
Why it matters:
- Useful in auditing user activity
- Helps detect abnormal session behavior
4. Event ID 4648 – Logon Using Explicit Credentials
Category: Security
Meaning: A user logged in using different credentials than their own.
Key Details:
- Often triggered by:
Run as different user- Services using stored credentials
- Shows both calling user and target user
Why it matters:
- Common in lateral movement attacks
- Important for privilege misuse detection
5. Event ID 4672 – Special Privileges Assigned
Category: Security
Meaning: An account logged in with administrative privileges.
Key Details:
- Indicates privileges like:
- SeDebugPrivilege
- SeTakeOwnershipPrivilege
- Typically applies to Administrators
Why it matters:
- Confirms elevated access
- Critical for detecting privilege escalation
6. Event ID 4688 – Process Creation
Category: Security
Meaning: A new process was started.
Key Details:
- Shows:
- Executable name
- Parent process
- Command-line arguments (if enabled)
Why it matters:
- Essential for malware detection
- Used in threat hunting
7. Event ID 4697 – Service Installed
Category: Security
Meaning: A new Windows service was installed.
Key Details:
- Shows:
- Service name
- Executable path
- Account used
Why it matters:
- Malware often installs itself as a service
- Important persistence mechanism
8. Event ID 4719 – System Audit Policy Changed
Category: Security
Meaning: Audit policy was modified.
Key Details:
- Indicates enabling/disabling of logging
- Shows who made the change
Why it matters:
- Attackers may disable logging to hide activity
- Critical security configuration change
9. Event ID 4720 – User Account Created
Category: Security
Meaning: A new user account was created.
Key Details:
- Shows:
- Creator account
- New username
- Domain/local scope
Why it matters:
- Unauthorized account creation is a major red flag
- Often used for persistence
10. Event ID 4740 – User Account Locked Out
Category: Security
Meaning: An account was locked due to failed login attempts.
Key Details:
- Shows:
- Locked account
- Source computer
Why it matters:
- Indicates brute-force attempts
- Helps identify compromised systems
Summary Table
| Event ID | Description |
|---|---|
| 4624 | Successful logon |
| 4625 | Failed logon |
| 4634 | Logoff |
| 4648 | Logon with explicit credentials |
| 4672 | Admin privileges assigned |
| 4688 | Process created |
| 4697 | Service installed |
| 4719 | Audit policy changed |
| 4720 | User account created |
| 4740 | Account locked |
