Windows Event ID Cheat Sheet: Logon, Service and Disk Events

Start here

Who locked this account out?

4740 on the PDC emulator

Who logged on, and how?

4624 plus the logon type

Why did the logon fail?

4625 status code

Did the server crash or reboot cleanly?

6008, 1074, 41

Did a service die?

7031, 7034, 7000

Is the disk failing?

7, 51, 153, 55

Read the log, not the ID alone. The same ID means different things per provider. Always pair the Event ID with the log name and the provider that wrote it.

Which log holds what

Looking for	Log
Logons, lockouts, privilege use, audit policy	`Security`
Drivers, services, disks, boot and shutdown	`System`
Application crashes and hangs	`Application`
Servicing and feature installs	`Setup` plus `CBS.log`
Scheduled task results	`Microsoft-Windows-TaskScheduler/Operational`
RDP session logon and logoff	`TerminalServices-LocalSessionManager/Operational`
RDP incoming connections and source IP	`TerminalServices-RemoteConnectionManager/Operational`
Windows Update install results	`WindowsUpdateClient/Operational`
Group Policy processing	`GroupPolicy/Operational`
SMB share connectivity	`SMBClient/Connectivity`
Slow boot and slow logon	`Diagnostics-Performance/Operational`
AD replication and directory errors	`Directory Service`

Logon and logoff

ID	Meaning
`4624`	Logon succeeded
`4625`	Logon failed
`4634`	Logoff
`4647`	User initiated logoff
`4648`	Logon using explicit credentials (runas, mapped drive)
`4672`	Special privileges assigned, in practice an admin logon
`4778` / `4779`	Session reconnected / disconnected
`4800` / `4801`	Workstation locked / unlocked

Logon types

Type	What it was
`2`	Interactive, at the console
`3`	Network, a share or a remote PowerShell call
`4`	Batch, a scheduled task
`5`	Service, started by the SCM
`7`	Unlock of an existing session
`8`	Network with a cleartext password, often IIS basic auth
`9`	New credentials, runas /netonly
`10`	RemoteInteractive, RDP
`11`	Cached interactive, no DC was reachable

Failed logon status codes

Status	Reason
`0xC0000064`	User name does not exist
`0xC000006A`	Correct user name, wrong password
`0xC0000234`	Account is locked out
`0xC0000072`	Account is disabled
`0xC0000193`	Account has expired
`0xC0000071`	Password has expired
`0xC0000224`	User must change password at next logon
`0xC000006F`	Logon outside permitted hours
`0xC0000070`	Workstation restriction
`0xC0000133`	Clock skew between client and DC

Read the substatus. The Status field is often the generic 0xC000006D. The real reason sits in Sub Status.

Account management and lockouts

ID	Meaning
`4720`	User account created
`4722`	User account enabled
`4723`	User changed their own password
`4724`	Admin reset a password
`4725`	User account disabled
`4726`	User account deleted
`4738`	User account changed
`4740`	Account locked out
`4767`	Account unlocked
`4728` / `4729`	Member added to / removed from a global group
`4732` / `4733`	Member added to / removed from a local group
`4756` / `4757`	Member added to / removed from a universal group

Lockouts live on one DC. Every 4740 is written on the PDC emulator. Query that DC, then read the Caller Computer Name field to find the machine still presenting the old password.

Kerberos and NTLM

ID	Meaning
`4768`	TGT requested, the user authenticated to the KDC
`4769`	Service ticket requested, the user reached a service
`4770`	Ticket renewed
`4771`	Kerberos pre-authentication failed
`4776`	NTLM credential validation, success or failure
`4769` + `0x1F`	Integrity check failed, often a duplicate SPN

Result code	Reason
`0x6`	Client not found, the user name does not exist
`0x12`	Account disabled, expired or locked out
`0x17`	Password expired
`0x18`	Wrong password
`0x25`	Clock skew too great
`0xE`	No matching encryption type

Boot, shutdown and services

ID	Provider	Meaning
`6005`	EventLog	Event log service started, the machine booted
`6006`	EventLog	Event log service stopped, a clean shutdown
`6008`	EventLog	Previous shutdown was unexpected
`6013`	EventLog	System uptime, written daily
`1074`	User32	Shutdown or restart requested, names the process and user
`41`	Kernel-Power	Rebooted without a clean shutdown, power loss or bugcheck
`1001`	BugCheck	Blue screen, carries the stop code
`7000`	Service Control Manager	Service failed to start
`7009`	Service Control Manager	Timed out connecting to the service
`7011`	Service Control Manager	Service did not answer in time
`7031`	Service Control Manager	Service terminated unexpectedly, recovery action follows
`7034`	Service Control Manager	Service terminated unexpectedly, no recovery configured
`7036`	Service Control Manager	Service entered the running or stopped state
`7045`	Service Control Manager	A new service was installed

7045 is worth an alert. A service appearing out of nowhere on a member server is either a deployment you did not do, or an intrusion.

Disk, storage and NTFS

ID	Provider	Meaning
`7`	disk	Bad block on the device
`11`	disk / controller	Controller error, often cabling or HBA
`51`	disk	Error during a paging operation
`52`	disk	Predictive failure, SMART warning
`153`	disk	IO retried, usually a failing path or disk
`129`	storahci / storport	Reset to device issued, the disk stopped answering
`55`	Ntfs	File system structure is corrupt, run chkdsk
`98`	Ntfs	Volume corruption detected
`140`	Ntfs	Failed to flush data to the transaction log
`2013`	srv	Disk is at or near capacity

129 and 153 are not noise. Repeated resets and retries on a production volume mean the storage path is already failing. Check the array before the next reboot decides for you.

Applications and updates

ID	Provider	Meaning
`1000`	Application Error	Application crashed, names the module and offset
`1002`	Application Hang	Application stopped responding
`1026`	.NET Runtime	Unhandled .NET exception
`1001`	Windows Error Reporting	Crash bucket, useful for grouping repeats
`43`	WindowsUpdateClient	Installation started
`19`	WindowsUpdateClient	Installation succeeded
`20`	WindowsUpdateClient	Installation failed, carries the error code
`44`	WindowsUpdateClient	Download started

RDP sessions and scheduled tasks

ID	Channel	Meaning
`1149`	RemoteConnectionManager	Network connection accepted, carries the source IP
`21`	LocalSessionManager	Session logon succeeded
`23`	LocalSessionManager	Session logoff
`24`	LocalSessionManager	Session disconnected
`25`	LocalSessionManager	Session reconnected
`101`	TaskScheduler	Task failed to start
`103`	TaskScheduler	Action failed to start
`111`	TaskScheduler	Task terminated by the scheduler
`201`	TaskScheduler	Action completed, carries the return code
`332`	TaskScheduler	Wrong credentials or the account cannot log on as batch

Get-WinEvent

Task	Command
Last 50 System entries	`Get-WinEvent -LogName System -MaxEvents 50`
Failed logons in the last day	`Get-WinEvent -FilterHashtable @{LogName='Security';Id=4625;StartTime=(Get-Date).AddDays(-1)}`
Errors and criticals only	`Get-WinEvent -FilterHashtable @{LogName='System';Level=1,2}`
One provider	`Get-WinEvent -FilterHashtable @{LogName='System';ProviderName='disk'}`
An operational channel	`Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-TaskScheduler/Operational';Id=101}`
Remote machine	`Get-WinEvent -ComputerName SRV01 -FilterHashtable @{LogName='System';Id=7031}`
Read a saved file	`Get-WinEvent -Path C:\temp\system.evtx -Oldest`
Logs that actually contain records	`Get-WinEvent -ListLog * \| Where-Object RecordCount -gt 0`
Readable output	`... \| Select-Object TimeCreated,Id,LevelDisplayName,Message`
Named field instead of the message blob	`$e.Properties[5].Value` or `([xml]$e.ToXml())`

Level	Meaning
`1`	Critical
`2`	Error
`3`	Warning
`4`	Information
`5`	Verbose

Filter at the source. -FilterHashtable is evaluated by the log service. Piping everything into Where-Object pulls the whole log across the wire and can take minutes on a busy DC.

wevtutil

Task	Command
List every log and channel	`wevtutil el`
Configuration of one log	`wevtutil gl System`
Record count and file size	`wevtutil gli System`
Last 20 entries, newest first	`wevtutil qe System /c:20 /rd:true /f:text`
One Event ID	`wevtutil qe Security /q:"*[System[(EventID=4625)]]" /c:10 /rd:true /f:text`
Export a log to a file	`wevtutil epl System C:\temp\system.evtx`
Export with the message strings included	`wevtutil al C:\temp\system.evtx`
Raise the maximum size to 100 MB	`wevtutil sl System /ms:104857600`
Enable a disabled channel	`wevtutil sl "Microsoft-Windows-TaskScheduler/Operational" /e:true`
Clear a log	`wevtutil cl System`

Clearing is not troubleshooting. wevtutil cl destroys the evidence you are about to need. Export with epl first, and never clear the Security log on a machine under investigation.

XPath filters

Filter	Matches
`*[System[(EventID=4625)]]`	One Event ID
`*[System[(EventID=4624 or EventID=4634)]]`	Either of two IDs
`*[System[(Level=1 or Level=2)]]`	Critical and error only
`*[System[Provider[@Name='disk']]]`	One provider
`*[System[TimeCreated[timediff(@SystemTime) <= 86400000]]]`	Last 24 hours, in milliseconds
`*[EventData[Data[@Name='TargetUserName']='jdoe']]`	One user inside the event data
`*[EventData[Data[@Name='LogonType']='10']]`	RDP logons only

Build it in the GUI. Event Viewer, Filter Current Log, then the XML tab: it writes valid XPath for you, which you paste into wevtutil /q: or Get-WinEvent -FilterXPath.

FAQ

Event Viewer shows entries, but Get-WinEvent returns nothing. Why?

Almost always elevation. The Security log needs an administrative token, and a non-elevated console returns “No events were found” rather than an access error. The second cause is a typo in a -FilterHashtable key, which is silently treated as no match.

Which machine holds the answer to a lockout?

The PDC emulator. Find it with netdom query fsmo, then query 4740 there and read Caller Computer Name. That is the machine still sending the old password, typically a stale mapped drive, a service account or a phone with a saved mailbox password.

Why does 4625 sometimes show an empty source address?

The field is filled by the network layer, so it stays empty for local and service logons. For RDP, the reliable source of the client IP is 1149 in the RemoteConnectionManager channel, not the Security log.

How far back does a log go?

Until the file hits its maximum size and starts overwriting. Check with wevtutil gl Security, and on anything you may need to audit, raise /ms: before an incident rather than after it.

Can I read an .evtx taken from another server?

Yes, with Get-WinEvent -Path file.evtx -Oldest. Message text is rendered from the provider’s resources, so a file read on a machine without that provider shows the data but not the formatted description. Export with wevtutil al to keep the strings.