Event ID lookup
Type an event ID to see what it means and how to pull it.
How to use it
- Type an event ID, such as 4740.
- Read what it means and which log it lives in.
- Copy the command to pull those events from a PC or domain controller.
Event IDs
- Event ID 4624 (Security): An account was successfully logged on
- Event ID 4625 (Security): An account failed to log on
- Event ID 4634 (Security): An account was logged off
- Event ID 4720 (Security): A user account was created
- Event ID 4722 (Security): A user account was enabled
- Event ID 4725 (Security): A user account was disabled
- Event ID 4728 (Security): A member was added to a security-enabled global group
- Event ID 4740 (Security): A user account was locked out
- Event ID 4767 (Security): A user account was unlocked
- Event ID 4771 (Security): Kerberos pre-authentication failed
- Event ID 41 (System): The system rebooted without cleanly shutting down first (Kernel-Power)
- Event ID 1074 (System): A process or user started a restart or shutdown
- Event ID 6005 (System): The Event Log service was started (boot)
- Event ID 6006 (System): The Event Log service was stopped (clean shutdown)
- Event ID 6008 (System): The previous system shutdown was unexpected
- Event ID 7036 (System): A service entered the running or stopped state
- Event ID 1000 (Application): An application crashed (Application Error)