mirror of
https://github.com/Yamato-Security/WELA.git
synced 2025-12-06 09:12:46 +01:00
37 KiB
37 KiB
| 1 | Event ID | Category | Subcategory | GUID |
|---|---|---|---|---|
| 2 | System | 69979848-797A-11D9-BED3-505054503030 | ||
| 3 | 4608 | System | Security State Change | 0CCE9210-69AE-11D9-BED3-505054503030 |
| 4 | 4616 | System | Security State Change | 0CCE9210-69AE-11D9-BED3-505054503030 |
| 5 | 4621 | System | Security State Change | 0CCE9210-69AE-11D9-BED3-505054503030 |
| 6 | 4610 | System | Security System Extension | 0CCE9211-69AE-11D9-BED3-505054503030 |
| 7 | 4611 | System | Security System Extension | 0CCE9211-69AE-11D9-BED3-505054503030 |
| 8 | 4614 | System | Security System Extension | 0CCE9211-69AE-11D9-BED3-505054503030 |
| 9 | 4622 | System | Security System Extension | 0CCE9211-69AE-11D9-BED3-505054503030 |
| 10 | 4697 | System | Security System Extension | 0CCE9211-69AE-11D9-BED3-505054503030 |
| 11 | 4612 | System | System Integrity | 0CCE9212-69AE-11D9-BED3-505054503030 |
| 12 | 4615 | System | System Integrity | 0CCE9212-69AE-11D9-BED3-505054503030 |
| 13 | 4618 | System | System Integrity | 0CCE9212-69AE-11D9-BED3-505054503030 |
| 14 | 4816 | System | System Integrity | 0CCE9212-69AE-11D9-BED3-505054503030 |
| 15 | 5038 | System | System Integrity | 0CCE9212-69AE-11D9-BED3-505054503030 |
| 16 | 5056 | System | System Integrity | 0CCE9212-69AE-11D9-BED3-505054503030 |
| 17 | 5057 | System | System Integrity | 0CCE9212-69AE-11D9-BED3-505054503030 |
| 18 | 5060 | System | System Integrity | 0CCE9212-69AE-11D9-BED3-505054503030 |
| 19 | 5061 | System | System Integrity | 0CCE9212-69AE-11D9-BED3-505054503030 |
| 20 | 5062 | System | System Integrity | 0CCE9212-69AE-11D9-BED3-505054503030 |
| 21 | 6281 | System | System Integrity | 0CCE9212-69AE-11D9-BED3-505054503030 |
| 22 | 6410 | System | System Integrity | 0CCE9212-69AE-11D9-BED3-505054503030 |
| 23 | 4960 | System | IPsec Driver | 0CCE9213-69AE-11D9-BED3-505054503030 |
| 24 | 4961 | System | IPsec Driver | 0CCE9213-69AE-11D9-BED3-505054503030 |
| 25 | 4962 | System | IPsec Driver | 0CCE9213-69AE-11D9-BED3-505054503030 |
| 26 | 4963 | System | IPsec Driver | 0CCE9213-69AE-11D9-BED3-505054503030 |
| 27 | 4965 | System | IPsec Driver | 0CCE9213-69AE-11D9-BED3-505054503030 |
| 28 | 5478 | System | IPsec Driver | 0CCE9213-69AE-11D9-BED3-505054503030 |
| 29 | 5479 | System | IPsec Driver | 0CCE9213-69AE-11D9-BED3-505054503030 |
| 30 | 5480 | System | IPsec Driver | 0CCE9213-69AE-11D9-BED3-505054503030 |
| 31 | 5483 | System | IPsec Driver | 0CCE9213-69AE-11D9-BED3-505054503030 |
| 32 | 5484 | System | IPsec Driver | 0CCE9213-69AE-11D9-BED3-505054503030 |
| 33 | 5485 | System | IPsec Driver | 0CCE9213-69AE-11D9-BED3-505054503030 |
| 34 | 5024 | System | Other System Events | 0CCE9214-69AE-11D9-BED3-505054503030 |
| 35 | 5025 | System | Other System Events | 0CCE9214-69AE-11D9-BED3-505054503030 |
| 36 | 5027 | System | Other System Events | 0CCE9214-69AE-11D9-BED3-505054503030 |
| 37 | 5028 | System | Other System Events | 0CCE9214-69AE-11D9-BED3-505054503030 |
| 38 | 5029 | System | Other System Events | 0CCE9214-69AE-11D9-BED3-505054503030 |
| 39 | 5030 | System | Other System Events | 0CCE9214-69AE-11D9-BED3-505054503030 |
| 40 | 5032 | System | Other System Events | 0CCE9214-69AE-11D9-BED3-505054503030 |
| 41 | 5033 | System | Other System Events | 0CCE9214-69AE-11D9-BED3-505054503030 |
| 42 | 5034 | System | Other System Events | 0CCE9214-69AE-11D9-BED3-505054503030 |
| 43 | 5035 | System | Other System Events | 0CCE9214-69AE-11D9-BED3-505054503030 |
| 44 | 5037 | System | Other System Events | 0CCE9214-69AE-11D9-BED3-505054503030 |
| 45 | 5058 | System | Other System Events | 0CCE9214-69AE-11D9-BED3-505054503030 |
| 46 | 5059 | System | Other System Events | 0CCE9214-69AE-11D9-BED3-505054503030 |
| 47 | 6400 | System | Other System Events | 0CCE9214-69AE-11D9-BED3-505054503030 |
| 48 | 6401 | System | Other System Events | 0CCE9214-69AE-11D9-BED3-505054503030 |
| 49 | 6402 | System | Other System Events | 0CCE9214-69AE-11D9-BED3-505054503030 |
| 50 | 6403 | System | Other System Events | 0CCE9214-69AE-11D9-BED3-505054503030 |
| 51 | 6405 | System | Other System Events | 0CCE9214-69AE-11D9-BED3-505054503030 |
| 52 | 6406 | System | Other System Events | 0CCE9214-69AE-11D9-BED3-505054503030 |
| 53 | 6407 | System | Other System Events | 0CCE9214-69AE-11D9-BED3-505054503030 |
| 54 | 6408 | System | Other System Events | 0CCE9214-69AE-11D9-BED3-505054503030 |
| 55 | 6409 | System | Other System Events | 0CCE9214-69AE-11D9-BED3-505054503030 |
| 56 | 4608 | Logon/Logoff | 69979849-797A-11D9-BED3-505054503030 | |
| 57 | 4616 | Logon/Logoff | 69979849-797A-11D9-BED3-505054503030 | |
| 58 | 4621 | Logon/Logoff | 69979849-797A-11D9-BED3-505054503030 | |
| 59 | 4624 | Logon/Logoff | Logon | 0CCE9215-69AE-11D9-BED3-505054503030 |
| 60 | 4625 | Logon/Logoff | Logon | 0CCE9215-69AE-11D9-BED3-505054503030 |
| 61 | 4648 | Logon/Logoff | Logon | 0CCE9215-69AE-11D9-BED3-505054503030 |
| 62 | 4675 | Logon/Logoff | Logon | 0CCE9215-69AE-11D9-BED3-505054503030 |
| 63 | 4634 | Logon/Logoff | Logoff | 0CCE9216-69AE-11D9-BED3-505054503030 |
| 64 | 4647 | Logon/Logoff | Logoff | 0CCE9216-69AE-11D9-BED3-505054503030 |
| 65 | 4625 | Logon/Logoff | Account Lockout | 0CCE9217-69AE-11D9-BED3-505054503030 |
| 66 | 4646 | Logon/Logoff | IPsec Main Mode | 0CCE9218-69AE-11D9-BED3-505054503030 |
| 67 | 4650 | Logon/Logoff | IPsec Main Mode | 0CCE9218-69AE-11D9-BED3-505054503030 |
| 68 | 4651 | Logon/Logoff | IPsec Main Mode | 0CCE9218-69AE-11D9-BED3-505054503030 |
| 69 | 4652 | Logon/Logoff | IPsec Main Mode | 0CCE9218-69AE-11D9-BED3-505054503030 |
| 70 | 4653 | Logon/Logoff | IPsec Main Mode | 0CCE9218-69AE-11D9-BED3-505054503030 |
| 71 | 4655 | Logon/Logoff | IPsec Main Mode | 0CCE9218-69AE-11D9-BED3-505054503030 |
| 72 | 4976 | Logon/Logoff | IPsec Main Mode | 0CCE9218-69AE-11D9-BED3-505054503030 |
| 73 | 5049 | Logon/Logoff | IPsec Main Mode | 0CCE9218-69AE-11D9-BED3-505054503030 |
| 74 | 5453 | Logon/Logoff | IPsec Main Mode | 0CCE9218-69AE-11D9-BED3-505054503030 |
| 75 | 4977 | Logon/Logoff | IPsec Quick Mode | 0CCE9219-69AE-11D9-BED3-505054503030 |
| 76 | 5451 | Logon/Logoff | IPsec Quick Mode | 0CCE9219-69AE-11D9-BED3-505054503030 |
| 77 | 5452 | Logon/Logoff | IPsec Quick Mode | 0CCE9219-69AE-11D9-BED3-505054503030 |
| 78 | 4978 | Logon/Logoff | IPsec Extended Mode | 0CCE921A-69AE-11D9-BED3-505054503030 |
| 79 | 4979 | Logon/Logoff | IPsec Extended Mode | 0CCE921A-69AE-11D9-BED3-505054503030 |
| 80 | 4980 | Logon/Logoff | IPsec Extended Mode | 0CCE921A-69AE-11D9-BED3-505054503030 |
| 81 | 4981 | Logon/Logoff | IPsec Extended Mode | 0CCE921A-69AE-11D9-BED3-505054503030 |
| 82 | 4982 | Logon/Logoff | IPsec Extended Mode | 0CCE921A-69AE-11D9-BED3-505054503030 |
| 83 | 4983 | Logon/Logoff | IPsec Extended Mode | 0CCE921A-69AE-11D9-BED3-505054503030 |
| 84 | 4984 | Logon/Logoff | IPsec Extended Mode | 0CCE921A-69AE-11D9-BED3-505054503030 |
| 85 | 4672 | Logon/Logoff | Special Logon | 0CCE921B-69AE-11D9-BED3-505054503030 |
| 86 | 4964 | Logon/Logoff | Special Logon | 0CCE921B-69AE-11D9-BED3-505054503030 |
| 87 | 4649 | Logon/Logoff | Other Logon/Logoff Events | 0CCE921C-69AE-11D9-BED3-505054503030 |
| 88 | 4778 | Logon/Logoff | Other Logon/Logoff Events | 0CCE921C-69AE-11D9-BED3-505054503030 |
| 89 | 4779 | Logon/Logoff | Other Logon/Logoff Events | 0CCE921C-69AE-11D9-BED3-505054503030 |
| 90 | 4800 | Logon/Logoff | Other Logon/Logoff Events | 0CCE921C-69AE-11D9-BED3-505054503030 |
| 91 | 4801 | Logon/Logoff | Other Logon/Logoff Events | 0CCE921C-69AE-11D9-BED3-505054503030 |
| 92 | 4802 | Logon/Logoff | Other Logon/Logoff Events | 0CCE921C-69AE-11D9-BED3-505054503030 |
| 93 | 4803 | Logon/Logoff | Other Logon/Logoff Events | 0CCE921C-69AE-11D9-BED3-505054503030 |
| 94 | 5378 | Logon/Logoff | Other Logon/Logoff Events | 0CCE921C-69AE-11D9-BED3-505054503030 |
| 95 | 5632 | Logon/Logoff | Other Logon/Logoff Events | 0CCE921C-69AE-11D9-BED3-505054503030 |
| 96 | 5633 | Logon/Logoff | Other Logon/Logoff Events | 0CCE921C-69AE-11D9-BED3-505054503030 |
| 97 | 6272 | Logon/Logoff | Network Policy Server | 0CCE9243-69AE-11D9-BED3-505054503030 |
| 98 | 6273 | Logon/Logoff | Network Policy Server | 0CCE9243-69AE-11D9-BED3-505054503030 |
| 99 | 6274 | Logon/Logoff | Network Policy Server | 0CCE9243-69AE-11D9-BED3-505054503030 |
| 100 | 6275 | Logon/Logoff | Network Policy Server | 0CCE9243-69AE-11D9-BED3-505054503030 |
| 101 | 6276 | Logon/Logoff | Network Policy Server | 0CCE9243-69AE-11D9-BED3-505054503030 |
| 102 | 6277 | Logon/Logoff | Network Policy Server | 0CCE9243-69AE-11D9-BED3-505054503030 |
| 103 | 6278 | Logon/Logoff | Network Policy Server | 0CCE9243-69AE-11D9-BED3-505054503030 |
| 104 | 6279 | Logon/Logoff | Network Policy Server | 0CCE9243-69AE-11D9-BED3-505054503030 |
| 105 | 6280 | Logon/Logoff | Network Policy Server | 0CCE9243-69AE-11D9-BED3-505054503030 |
| 106 | 4626 | Logon/Logoff | User / Device Claims | 0CCE9247-69AE-11D9-BED3-505054503030 |
| 107 | 4627 | Logon/Logoff | Group Membership | 0CCE9249-69AE-11D9-BED3-505054503030 |
| 108 | Object Access | 6997984A-797A-11D9-BED3-505054503030 | ||
| 109 | 4656 | Object Access | File System | 0CCE921D-69AE-11D9-BED3-505054503030 |
| 110 | 4658 | Object Access | File System | 0CCE921D-69AE-11D9-BED3-505054503030 |
| 111 | 4660 | Object Access | File System | 0CCE921D-69AE-11D9-BED3-505054503030 |
| 112 | 4663 | Object Access | File System | 0CCE921D-69AE-11D9-BED3-505054503030 |
| 113 | 4664 | Object Access | File System | 0CCE921D-69AE-11D9-BED3-505054503030 |
| 114 | 4985 | Object Access | File System | 0CCE921D-69AE-11D9-BED3-505054503030 |
| 115 | 5051 | Object Access | File System | 0CCE921D-69AE-11D9-BED3-505054503030 |
| 116 | 4670 | Object Access | File System | 0CCE921D-69AE-11D9-BED3-505054503030 |
| 117 | 4663 | Object Access | Registry | 0CCE921E-69AE-11D9-BED3-505054503030 |
| 118 | 4656 | Object Access | Registry | 0CCE921E-69AE-11D9-BED3-505054503030 |
| 119 | 4658 | Object Access | Registry | 0CCE921E-69AE-11D9-BED3-505054503030 |
| 120 | 4660 | Object Access | Registry | 0CCE921E-69AE-11D9-BED3-505054503030 |
| 121 | 4657 | Object Access | Registry | 0CCE921E-69AE-11D9-BED3-505054503030 |
| 122 | 5039 | Object Access | Registry | 0CCE921E-69AE-11D9-BED3-505054503030 |
| 123 | 4670 | Object Access | Registry | 0CCE921E-69AE-11D9-BED3-505054503030 |
| 124 | 4656 | Object Access | Kernel Object | 0CCE921F-69AE-11D9-BED3-505054503030 |
| 125 | 4658 | Object Access | Kernel Object | 0CCE921F-69AE-11D9-BED3-505054503030 |
| 126 | 4660 | Object Access | Kernel Object | 0CCE921F-69AE-11D9-BED3-505054503030 |
| 127 | 4663 | Object Access | Kernel Object | 0CCE921F-69AE-11D9-BED3-505054503030 |
| 128 | 4661 | Object Access | SAM | 0CCE9220-69AE-11D9-BED3-505054503030 |
| 129 | 4868 | Object Access | Certification Services | 0CCE9221-69AE-11D9-BED3-505054503030 |
| 130 | 4869 | Object Access | Certification Services | 0CCE9221-69AE-11D9-BED3-505054503030 |
| 131 | 4870 | Object Access | Certification Services | 0CCE9221-69AE-11D9-BED3-505054503030 |
| 132 | 4871 | Object Access | Certification Services | 0CCE9221-69AE-11D9-BED3-505054503030 |
| 133 | 4872 | Object Access | Certification Services | 0CCE9221-69AE-11D9-BED3-505054503030 |
| 134 | 4873 | Object Access | Certification Services | 0CCE9221-69AE-11D9-BED3-505054503030 |
| 135 | 4874 | Object Access | Certification Services | 0CCE9221-69AE-11D9-BED3-505054503030 |
| 136 | 4875 | Object Access | Certification Services | 0CCE9221-69AE-11D9-BED3-505054503030 |
| 137 | 4876 | Object Access | Certification Services | 0CCE9221-69AE-11D9-BED3-505054503030 |
| 138 | 4877 | Object Access | Certification Services | 0CCE9221-69AE-11D9-BED3-505054503030 |
| 139 | 4878 | Object Access | Certification Services | 0CCE9221-69AE-11D9-BED3-505054503030 |
| 140 | 4879 | Object Access | Certification Services | 0CCE9221-69AE-11D9-BED3-505054503030 |
| 141 | 4880 | Object Access | Certification Services | 0CCE9221-69AE-11D9-BED3-505054503030 |
| 142 | 4881 | Object Access | Certification Services | 0CCE9221-69AE-11D9-BED3-505054503030 |
| 143 | 4882 | Object Access | Certification Services | 0CCE9221-69AE-11D9-BED3-505054503030 |
| 144 | 4883 | Object Access | Certification Services | 0CCE9221-69AE-11D9-BED3-505054503030 |
| 145 | 4884 | Object Access | Certification Services | 0CCE9221-69AE-11D9-BED3-505054503030 |
| 146 | 4885 | Object Access | Certification Services | 0CCE9221-69AE-11D9-BED3-505054503030 |
| 147 | 4886 | Object Access | Certification Services | 0CCE9221-69AE-11D9-BED3-505054503030 |
| 148 | 4887 | Object Access | Certification Services | 0CCE9221-69AE-11D9-BED3-505054503030 |
| 149 | 4888 | Object Access | Certification Services | 0CCE9221-69AE-11D9-BED3-505054503030 |
| 150 | 4889 | Object Access | Certification Services | 0CCE9221-69AE-11D9-BED3-505054503030 |
| 151 | 4890 | Object Access | Certification Services | 0CCE9221-69AE-11D9-BED3-505054503030 |
| 152 | 4891 | Object Access | Certification Services | 0CCE9221-69AE-11D9-BED3-505054503030 |
| 153 | 4892 | Object Access | Certification Services | 0CCE9221-69AE-11D9-BED3-505054503030 |
| 154 | 4893 | Object Access | Certification Services | 0CCE9221-69AE-11D9-BED3-505054503030 |
| 155 | 4894 | Object Access | Certification Services | 0CCE9221-69AE-11D9-BED3-505054503030 |
| 156 | 4895 | Object Access | Certification Services | 0CCE9221-69AE-11D9-BED3-505054503030 |
| 157 | 4896 | Object Access | Certification Services | 0CCE9221-69AE-11D9-BED3-505054503030 |
| 158 | 4897 | Object Access | Certification Services | 0CCE9221-69AE-11D9-BED3-505054503030 |
| 159 | 4898 | Object Access | Certification Services | 0CCE9221-69AE-11D9-BED3-505054503030 |
| 160 | 4665 | Object Access | Application Generated | 0CCE9222-69AE-11D9-BED3-505054503030 |
| 161 | 4666 | Object Access | Application Generated | 0CCE9222-69AE-11D9-BED3-505054503030 |
| 162 | 4667 | Object Access | Application Generated | 0CCE9222-69AE-11D9-BED3-505054503030 |
| 163 | 4668 | Object Access | Application Generated | 0CCE9222-69AE-11D9-BED3-505054503030 |
| 164 | 4658 | Object Access | Handle Manipulation | 0CCE9223-69AE-11D9-BED3-505054503030 |
| 165 | 4690 | Object Access | Handle Manipulation | 0CCE9223-69AE-11D9-BED3-505054503030 |
| 166 | 4658 | Object Access | Handle Manipulation | 0CCE9223-69AE-11D9-BED3-505054503030 |
| 167 | 5140 | Object Access | File Share | 0CCE9224-69AE-11D9-BED3-505054503030 |
| 168 | 5142 | Object Access | File Share | 0CCE9224-69AE-11D9-BED3-505054503030 |
| 169 | 5143 | Object Access | File Share | 0CCE9224-69AE-11D9-BED3-505054503030 |
| 170 | 5144 | Object Access | File Share | 0CCE9224-69AE-11D9-BED3-505054503030 |
| 171 | 5168 | Object Access | File Share | 0CCE9224-69AE-11D9-BED3-505054503030 |
| 172 | 5152 | Object Access | Filtering Platform Packet Drop | 0CCE9225-69AE-11D9-BED3-505054503030 |
| 173 | 5153 | Object Access | Filtering Platform Packet Drop | 0CCE9225-69AE-11D9-BED3-505054503030 |
| 174 | 4671 | Object Access | Filtering Platform Connection | 0CCE9226-69AE-11D9-BED3-505054503030 |
| 175 | 4691 | Object Access | Filtering Platform Connection | 0CCE9226-69AE-11D9-BED3-505054503030 |
| 176 | 5148 | Object Access | Filtering Platform Connection | 0CCE9226-69AE-11D9-BED3-505054503030 |
| 177 | 5149 | Object Access | Filtering Platform Connection | 0CCE9226-69AE-11D9-BED3-505054503030 |
| 178 | 5156 | Object Access | Filtering Platform Connection | 0CCE9226-69AE-11D9-BED3-505054503030 |
| 179 | 5157 | Object Access | Filtering Platform Connection | 0CCE9226-69AE-11D9-BED3-505054503030 |
| 180 | 4698 | Object Access | Filtering Platform Connection | 0CCE9226-69AE-11D9-BED3-505054503030 |
| 181 | 4699 | Object Access | Filtering Platform Connection | 0CCE9226-69AE-11D9-BED3-505054503030 |
| 182 | 4700 | Object Access | Filtering Platform Connection | 0CCE9226-69AE-11D9-BED3-505054503030 |
| 183 | 4701 | Object Access | Filtering Platform Connection | 0CCE9226-69AE-11D9-BED3-505054503030 |
| 184 | 4702 | Object Access | Filtering Platform Connection | 0CCE9226-69AE-11D9-BED3-505054503030 |
| 185 | 5888 | Object Access | Filtering Platform Connection | 0CCE9226-69AE-11D9-BED3-505054503030 |
| 186 | 5889 | Object Access | Filtering Platform Connection | 0CCE9226-69AE-11D9-BED3-505054503030 |
| 187 | 5890 | Object Access | Filtering Platform Connection | 0CCE9226-69AE-11D9-BED3-505054503030 |
| 188 | 4671 | Object Access | Other Object Access Events | 0CCE9227-69AE-11D9-BED3-505054503030 |
| 189 | 4691 | Object Access | Other Object Access Events | 0CCE9227-69AE-11D9-BED3-505054503030 |
| 190 | 5148 | Object Access | Other Object Access Events | 0CCE9227-69AE-11D9-BED3-505054503030 |
| 191 | 5149 | Object Access | Other Object Access Events | 0CCE9227-69AE-11D9-BED3-505054503030 |
| 192 | 4698 | Object Access | Other Object Access Events | 0CCE9227-69AE-11D9-BED3-505054503030 |
| 193 | 4699 | Object Access | Other Object Access Events | 0CCE9227-69AE-11D9-BED3-505054503030 |
| 194 | 4700 | Object Access | Other Object Access Events | 0CCE9227-69AE-11D9-BED3-505054503030 |
| 195 | 4701 | Object Access | Other Object Access Events | 0CCE9227-69AE-11D9-BED3-505054503030 |
| 196 | 4702 | Object Access | Other Object Access Events | 0CCE9227-69AE-11D9-BED3-505054503030 |
| 197 | 5888 | Object Access | Other Object Access Events | 0CCE9227-69AE-11D9-BED3-505054503030 |
| 198 | 5889 | Object Access | Other Object Access Events | 0CCE9227-69AE-11D9-BED3-505054503030 |
| 199 | 5890 | Object Access | Other Object Access Events | 0CCE9227-69AE-11D9-BED3-505054503030 |
| 200 | 5145 | Object Access | Detailed File Share | 0CCE9244-69AE-11D9-BED3-505054503030 |
| 201 | 4656 | Object Access | Removable Storage | 0CCE9245-69AE-11D9-BED3-505054503030 |
| 202 | 4658 | Object Access | Removable Storage | 0CCE9245-69AE-11D9-BED3-505054503030 |
| 203 | 4663 | Object Access | Removable Storage | 0CCE9245-69AE-11D9-BED3-505054503030 |
| 204 | Object Access | Central Policy Staging | 0CCE9246-69AE-11D9-BED3-505054503030 | |
| 205 | Privilege Use | 6997984B-797A-11D9-BED3-505054503030 | ||
| 206 | 4673 | Privilege Use | Sensitive Privilege Use | 0CCE9228-69AE-11D9-BED3-505054503030 |
| 207 | 4574 | Privilege Use | Sensitive Privilege Use | 0CCE9228-69AE-11D9-BED3-505054503030 |
| 208 | 4985 | Privilege Use | Sensitive Privilege Use | 0CCE9228-69AE-11D9-BED3-505054503030 |
| 209 | 4673 | Privilege Use | Non Sensitive Privilege Use | 0CCE9229-69AE-11D9-BED3-505054503030 |
| 210 | 4674 | Privilege Use | Non Sensitive Privilege Use | 0CCE9229-69AE-11D9-BED3-505054503030 |
| 211 | 4985 | Privilege Use | Non Sensitive Privilege Use | 0CCE9229-69AE-11D9-BED3-505054503030 |
| 212 | 4985 | Privilege Use | Other Privilege Use Events | 0CCE922A-69AE-11D9-BED3-505054503030 |
| 213 | Detailed Tracking | 6997984C-797A-11D9-BED3-505054503030 | ||
| 214 | 4688 | Detailed Tracking | Process Creation | 0CCE922B-69AE-11D9-BED3-505054503030 |
| 215 | 4696 | Detailed Tracking | Process Creation | 0CCE922B-69AE-11D9-BED3-505054503030 |
| 216 | 4689 | Detailed Tracking | Process Termination | 0CCE922C-69AE-11D9-BED3-505054503030 |
| 217 | 4692 | Detailed Tracking | DPAPI Activity | 0CCE922D-69AE-11D9-BED3-505054503030 |
| 218 | 4693 | Detailed Tracking | DPAPI Activity | 0CCE922D-69AE-11D9-BED3-505054503030 |
| 219 | 4694 | Detailed Tracking | DPAPI Activity | 0CCE922D-69AE-11D9-BED3-505054503030 |
| 220 | 4695 | Detailed Tracking | DPAPI Activity | 0CCE922D-69AE-11D9-BED3-505054503030 |
| 221 | 5712 | Detailed Tracking | RPC Events | 0CCE922E-69AE-11D9-BED3-505054503030 |
| 222 | 6416 | Detailed Tracking | Plug and Play Events | 0CCE9248-69AE-11D9-BED3-505054503030 |
| 223 | 6419 | Detailed Tracking | Plug and Play Events | 0CCE9248-69AE-11D9-BED3-505054503030 |
| 224 | 6420 | Detailed Tracking | Plug and Play Events | 0CCE9248-69AE-11D9-BED3-505054503030 |
| 225 | 6421 | Detailed Tracking | Plug and Play Events | 0CCE9248-69AE-11D9-BED3-505054503030 |
| 226 | 6422 | Detailed Tracking | Plug and Play Events | 0CCE9248-69AE-11D9-BED3-505054503030 |
| 227 | 6423 | Detailed Tracking | Plug and Play Events | 0CCE9248-69AE-11D9-BED3-505054503030 |
| 228 | 6424 | Detailed Tracking | Plug and Play Events | 0CCE9248-69AE-11D9-BED3-505054503030 |
| 229 | 4703 | Detailed Tracking | Token Right Adjusted Events | 0CCE924A-69AE-11D9-BED3-505054503030 |
| 230 | Policy Change | 6997984D-797A-11D9-BED3-505054503030 | ||
| 231 | 4902 | Policy Change | Audit Policy Change | 0CCE922F-69AE-11D9-BED3-505054503030 |
| 232 | 4907 | Policy Change | Audit Policy Change | 0CCE922F-69AE-11D9-BED3-505054503030 |
| 233 | 4904 | Policy Change | Audit Policy Change | 0CCE922F-69AE-11D9-BED3-505054503030 |
| 234 | 4905 | Policy Change | Audit Policy Change | 0CCE922F-69AE-11D9-BED3-505054503030 |
| 235 | 4715 | Policy Change | Audit Policy Change | 0CCE922F-69AE-11D9-BED3-505054503030 |
| 236 | 4719 | Policy Change | Audit Policy Change | 0CCE922F-69AE-11D9-BED3-505054503030 |
| 237 | 4817 | Policy Change | Audit Policy Change | 0CCE922F-69AE-11D9-BED3-505054503030 |
| 238 | 4902 | Policy Change | Audit Policy Change | 0CCE922F-69AE-11D9-BED3-505054503030 |
| 239 | 4906 | Policy Change | Audit Policy Change | 0CCE922F-69AE-11D9-BED3-505054503030 |
| 240 | 4907 | Policy Change | Audit Policy Change | 0CCE922F-69AE-11D9-BED3-505054503030 |
| 241 | 4908 | Policy Change | Audit Policy Change | 0CCE922F-69AE-11D9-BED3-505054503030 |
| 242 | 4912 | Policy Change | Audit Policy Change | 0CCE922F-69AE-11D9-BED3-505054503030 |
| 243 | 4904 | Policy Change | Audit Policy Change | 0CCE922F-69AE-11D9-BED3-505054503030 |
| 244 | 4905 | Policy Change | Audit Policy Change | 0CCE922F-69AE-11D9-BED3-505054503030 |
| 245 | 4670 | Policy Change | Authentication Policy Change | 0CCE9230-69AE-11D9-BED3-505054503030 |
| 246 | 4706 | Policy Change | Authentication Policy Change | 0CCE9230-69AE-11D9-BED3-505054503030 |
| 247 | 4707 | Policy Change | Authentication Policy Change | 0CCE9230-69AE-11D9-BED3-505054503030 |
| 248 | 4716 | Policy Change | Authentication Policy Change | 0CCE9230-69AE-11D9-BED3-505054503030 |
| 249 | 4713 | Policy Change | Authentication Policy Change | 0CCE9230-69AE-11D9-BED3-505054503030 |
| 250 | 4717 | Policy Change | Authentication Policy Change | 0CCE9230-69AE-11D9-BED3-505054503030 |
| 251 | 4718 | Policy Change | Authentication Policy Change | 0CCE9230-69AE-11D9-BED3-505054503030 |
| 252 | 4739 | Policy Change | Authentication Policy Change | 0CCE9230-69AE-11D9-BED3-505054503030 |
| 253 | 4864 | Policy Change | Authentication Policy Change | 0CCE9230-69AE-11D9-BED3-505054503030 |
| 254 | 4865 | Policy Change | Authentication Policy Change | 0CCE9230-69AE-11D9-BED3-505054503030 |
| 255 | 4866 | Policy Change | Authentication Policy Change | 0CCE9230-69AE-11D9-BED3-505054503030 |
| 256 | 4867 | Policy Change | Authentication Policy Change | 0CCE9230-69AE-11D9-BED3-505054503030 |
| 257 | 4703 | Policy Change | Authorization Policy Change | 0CCE9231-69AE-11D9-BED3-505054503030 |
| 258 | 4704 | Policy Change | Authorization Policy Change | 0CCE9231-69AE-11D9-BED3-505054503030 |
| 259 | 4705 | Policy Change | Authorization Policy Change | 0CCE9231-69AE-11D9-BED3-505054503030 |
| 260 | 4670 | Policy Change | Authorization Policy Change | 0CCE9231-69AE-11D9-BED3-505054503030 |
| 261 | 4911 | Policy Change | Authorization Policy Change | 0CCE9231-69AE-11D9-BED3-505054503030 |
| 262 | 4913 | Policy Change | Authorization Policy Change | 0CCE9231-69AE-11D9-BED3-505054503030 |
| 263 | 4944 | Policy Change | MPSSVC Rule-Level Policy Change | 0CCE9232-69AE-11D9-BED3-505054503030 |
| 264 | 4945 | Policy Change | MPSSVC Rule-Level Policy Change | 0CCE9232-69AE-11D9-BED3-505054503030 |
| 265 | 4946 | Policy Change | MPSSVC Rule-Level Policy Change | 0CCE9232-69AE-11D9-BED3-505054503030 |
| 266 | 4947 | Policy Change | MPSSVC Rule-Level Policy Change | 0CCE9232-69AE-11D9-BED3-505054503030 |
| 267 | 4948 | Policy Change | MPSSVC Rule-Level Policy Change | 0CCE9232-69AE-11D9-BED3-505054503030 |
| 268 | 4949 | Policy Change | MPSSVC Rule-Level Policy Change | 0CCE9232-69AE-11D9-BED3-505054503030 |
| 269 | 4950 | Policy Change | MPSSVC Rule-Level Policy Change | 0CCE9232-69AE-11D9-BED3-505054503030 |
| 270 | 4951 | Policy Change | MPSSVC Rule-Level Policy Change | 0CCE9232-69AE-11D9-BED3-505054503030 |
| 271 | 4952 | Policy Change | MPSSVC Rule-Level Policy Change | 0CCE9232-69AE-11D9-BED3-505054503030 |
| 272 | 4953 | Policy Change | MPSSVC Rule-Level Policy Change | 0CCE9232-69AE-11D9-BED3-505054503030 |
| 273 | 4954 | Policy Change | MPSSVC Rule-Level Policy Change | 0CCE9232-69AE-11D9-BED3-505054503030 |
| 274 | 4956 | Policy Change | MPSSVC Rule-Level Policy Change | 0CCE9232-69AE-11D9-BED3-505054503030 |
| 275 | 4957 | Policy Change | MPSSVC Rule-Level Policy Change | 0CCE9232-69AE-11D9-BED3-505054503030 |
| 276 | 4958 | Policy Change | MPSSVC Rule-Level Policy Change | 0CCE9232-69AE-11D9-BED3-505054503030 |
| 277 | 4709 | Policy Change | Filtering Platform Policy Change | 0CCE9233-69AE-11D9-BED3-505054503030 |
| 278 | 4710 | Policy Change | Filtering Platform Policy Change | 0CCE9233-69AE-11D9-BED3-505054503030 |
| 279 | 4711 | Policy Change | Filtering Platform Policy Change | 0CCE9233-69AE-11D9-BED3-505054503030 |
| 280 | 4712 | Policy Change | Filtering Platform Policy Change | 0CCE9233-69AE-11D9-BED3-505054503030 |
| 281 | 5040 | Policy Change | Filtering Platform Policy Change | 0CCE9233-69AE-11D9-BED3-505054503030 |
| 282 | 5041 | Policy Change | Filtering Platform Policy Change | 0CCE9233-69AE-11D9-BED3-505054503030 |
| 283 | 5042 | Policy Change | Filtering Platform Policy Change | 0CCE9233-69AE-11D9-BED3-505054503030 |
| 284 | 5043 | Policy Change | Filtering Platform Policy Change | 0CCE9233-69AE-11D9-BED3-505054503030 |
| 285 | 5044 | Policy Change | Filtering Platform Policy Change | 0CCE9233-69AE-11D9-BED3-505054503030 |
| 286 | 5045 | Policy Change | Filtering Platform Policy Change | 0CCE9233-69AE-11D9-BED3-505054503030 |
| 287 | 5046 | Policy Change | Filtering Platform Policy Change | 0CCE9233-69AE-11D9-BED3-505054503030 |
| 288 | 5047 | Policy Change | Filtering Platform Policy Change | 0CCE9233-69AE-11D9-BED3-505054503030 |
| 289 | 5048 | Policy Change | Filtering Platform Policy Change | 0CCE9233-69AE-11D9-BED3-505054503030 |
| 290 | 5440 | Policy Change | Filtering Platform Policy Change | 0CCE9233-69AE-11D9-BED3-505054503030 |
| 291 | 5441 | Policy Change | Filtering Platform Policy Change | 0CCE9233-69AE-11D9-BED3-505054503030 |
| 292 | 5442 | Policy Change | Filtering Platform Policy Change | 0CCE9233-69AE-11D9-BED3-505054503030 |
| 293 | 5443 | Policy Change | Filtering Platform Policy Change | 0CCE9233-69AE-11D9-BED3-505054503030 |
| 294 | 5444 | Policy Change | Filtering Platform Policy Change | 0CCE9233-69AE-11D9-BED3-505054503030 |
| 295 | 5446 | Policy Change | Filtering Platform Policy Change | 0CCE9233-69AE-11D9-BED3-505054503030 |
| 296 | 5448 | Policy Change | Filtering Platform Policy Change | 0CCE9233-69AE-11D9-BED3-505054503030 |
| 297 | 5449 | Policy Change | Filtering Platform Policy Change | 0CCE9233-69AE-11D9-BED3-505054503030 |
| 298 | 5450 | Policy Change | Filtering Platform Policy Change | 0CCE9233-69AE-11D9-BED3-505054503030 |
| 299 | 5456 | Policy Change | Filtering Platform Policy Change | 0CCE9233-69AE-11D9-BED3-505054503030 |
| 300 | 5457 | Policy Change | Filtering Platform Policy Change | 0CCE9233-69AE-11D9-BED3-505054503030 |
| 301 | 5458 | Policy Change | Filtering Platform Policy Change | 0CCE9233-69AE-11D9-BED3-505054503030 |
| 302 | 5459 | Policy Change | Filtering Platform Policy Change | 0CCE9233-69AE-11D9-BED3-505054503030 |
| 303 | 5460 | Policy Change | Filtering Platform Policy Change | 0CCE9233-69AE-11D9-BED3-505054503030 |
| 304 | 5461 | Policy Change | Filtering Platform Policy Change | 0CCE9233-69AE-11D9-BED3-505054503030 |
| 305 | 5462 | Policy Change | Filtering Platform Policy Change | 0CCE9233-69AE-11D9-BED3-505054503030 |
| 306 | 5463 | Policy Change | Filtering Platform Policy Change | 0CCE9233-69AE-11D9-BED3-505054503030 |
| 307 | 5464 | Policy Change | Filtering Platform Policy Change | 0CCE9233-69AE-11D9-BED3-505054503030 |
| 308 | 5465 | Policy Change | Filtering Platform Policy Change | 0CCE9233-69AE-11D9-BED3-505054503030 |
| 309 | 5466 | Policy Change | Filtering Platform Policy Change | 0CCE9233-69AE-11D9-BED3-505054503030 |
| 310 | 5467 | Policy Change | Filtering Platform Policy Change | 0CCE9233-69AE-11D9-BED3-505054503030 |
| 311 | 5468 | Policy Change | Filtering Platform Policy Change | 0CCE9233-69AE-11D9-BED3-505054503030 |
| 312 | 5471 | Policy Change | Filtering Platform Policy Change | 0CCE9233-69AE-11D9-BED3-505054503030 |
| 313 | 5472 | Policy Change | Filtering Platform Policy Change | 0CCE9233-69AE-11D9-BED3-505054503030 |
| 314 | 5473 | Policy Change | Filtering Platform Policy Change | 0CCE9233-69AE-11D9-BED3-505054503030 |
| 315 | 5474 | Policy Change | Filtering Platform Policy Change | 0CCE9233-69AE-11D9-BED3-505054503030 |
| 316 | 5477 | Policy Change | Filtering Platform Policy Change | 0CCE9233-69AE-11D9-BED3-505054503030 |
| 317 | 4714 | Policy Change | Other Policy Change Events | 0CCE9234-69AE-11D9-BED3-505054503030 |
| 318 | 4819 | Policy Change | Other Policy Change Events | 0CCE9234-69AE-11D9-BED3-505054503030 |
| 319 | 4826 | Policy Change | Other Policy Change Events | 0CCE9234-69AE-11D9-BED3-505054503030 |
| 320 | 4909 | Policy Change | Other Policy Change Events | 0CCE9234-69AE-11D9-BED3-505054503030 |
| 321 | 4910 | Policy Change | Other Policy Change Events | 0CCE9234-69AE-11D9-BED3-505054503030 |
| 322 | 5063 | Policy Change | Other Policy Change Events | 0CCE9234-69AE-11D9-BED3-505054503030 |
| 323 | 5064 | Policy Change | Other Policy Change Events | 0CCE9234-69AE-11D9-BED3-505054503030 |
| 324 | 5065 | Policy Change | Other Policy Change Events | 0CCE9234-69AE-11D9-BED3-505054503030 |
| 325 | 5066 | Policy Change | Other Policy Change Events | 0CCE9234-69AE-11D9-BED3-505054503030 |
| 326 | 5067 | Policy Change | Other Policy Change Events | 0CCE9234-69AE-11D9-BED3-505054503030 |
| 327 | 5068 | Policy Change | Other Policy Change Events | 0CCE9234-69AE-11D9-BED3-505054503030 |
| 328 | 5069 | Policy Change | Other Policy Change Events | 0CCE9234-69AE-11D9-BED3-505054503030 |
| 329 | 5070 | Policy Change | Other Policy Change Events | 0CCE9234-69AE-11D9-BED3-505054503030 |
| 330 | 5447 | Policy Change | Other Policy Change Events | 0CCE9234-69AE-11D9-BED3-505054503030 |
| 331 | 6144 | Policy Change | Other Policy Change Events | 0CCE9234-69AE-11D9-BED3-505054503030 |
| 332 | 6145 | Policy Change | Other Policy Change Events | 0CCE9234-69AE-11D9-BED3-505054503030 |
| 333 | Account Management | 6997984E-797A-11D9-BED3-505054503030 | ||
| 334 | 4720 | Account Management | User Account Management | 0CCE9235-69AE-11D9-BED3-505054503030 |
| 335 | 4722 | Account Management | User Account Management | 0CCE9235-69AE-11D9-BED3-505054503030 |
| 336 | 4723 | Account Management | User Account Management | 0CCE9235-69AE-11D9-BED3-505054503030 |
| 337 | 4724 | Account Management | User Account Management | 0CCE9235-69AE-11D9-BED3-505054503030 |
| 338 | 4725 | Account Management | User Account Management | 0CCE9235-69AE-11D9-BED3-505054503030 |
| 339 | 4726 | Account Management | User Account Management | 0CCE9235-69AE-11D9-BED3-505054503030 |
| 340 | 4738 | Account Management | User Account Management | 0CCE9235-69AE-11D9-BED3-505054503030 |
| 341 | 4740 | Account Management | User Account Management | 0CCE9235-69AE-11D9-BED3-505054503030 |
| 342 | 4765 | Account Management | User Account Management | 0CCE9235-69AE-11D9-BED3-505054503030 |
| 343 | 4766 | Account Management | User Account Management | 0CCE9235-69AE-11D9-BED3-505054503030 |
| 344 | 4767 | Account Management | User Account Management | 0CCE9235-69AE-11D9-BED3-505054503030 |
| 345 | 4780 | Account Management | User Account Management | 0CCE9235-69AE-11D9-BED3-505054503030 |
| 346 | 4781 | Account Management | User Account Management | 0CCE9235-69AE-11D9-BED3-505054503030 |
| 347 | 4794 | Account Management | User Account Management | 0CCE9235-69AE-11D9-BED3-505054503030 |
| 348 | 4798 | Account Management | User Account Management | 0CCE9235-69AE-11D9-BED3-505054503030 |
| 349 | 5376 | Account Management | User Account Management | 0CCE9235-69AE-11D9-BED3-505054503030 |
| 350 | 5377 | Account Management | User Account Management | 0CCE9235-69AE-11D9-BED3-505054503030 |
| 351 | 4741 | Account Management | Computer Account Management | 0CCE9236-69AE-11D9-BED3-505054503030 |
| 352 | 4742 | Account Management | Computer Account Management | 0CCE9236-69AE-11D9-BED3-505054503030 |
| 353 | 4743 | Account Management | Computer Account Management | 0CCE9236-69AE-11D9-BED3-505054503030 |
| 354 | 4731 | Account Management | Security Group Management | 0CCE9237-69AE-11D9-BED3-505054503030 |
| 355 | 4732 | Account Management | Security Group Management | 0CCE9237-69AE-11D9-BED3-505054503030 |
| 356 | 4733 | Account Management | Security Group Management | 0CCE9237-69AE-11D9-BED3-505054503030 |
| 357 | 4734 | Account Management | Security Group Management | 0CCE9237-69AE-11D9-BED3-505054503030 |
| 358 | 4735 | Account Management | Security Group Management | 0CCE9237-69AE-11D9-BED3-505054503030 |
| 359 | 4764 | Account Management | Security Group Management | 0CCE9237-69AE-11D9-BED3-505054503030 |
| 360 | 4799 | Account Management | Security Group Management | 0CCE9237-69AE-11D9-BED3-505054503030 |
| 361 | 4727 | Account Management | Security Group Management | 0CCE9237-69AE-11D9-BED3-505054503030 |
| 362 | 4737 | Account Management | Security Group Management | 0CCE9237-69AE-11D9-BED3-505054503030 |
| 363 | 4728 | Account Management | Security Group Management | 0CCE9237-69AE-11D9-BED3-505054503030 |
| 364 | 4729 | Account Management | Security Group Management | 0CCE9237-69AE-11D9-BED3-505054503030 |
| 365 | 4730 | Account Management | Security Group Management | 0CCE9237-69AE-11D9-BED3-505054503030 |
| 366 | 4754 | Account Management | Security Group Management | 0CCE9237-69AE-11D9-BED3-505054503030 |
| 367 | 4755 | Account Management | Security Group Management | 0CCE9237-69AE-11D9-BED3-505054503030 |
| 368 | 4756 | Account Management | Security Group Management | 0CCE9237-69AE-11D9-BED3-505054503030 |
| 369 | 4757 | Account Management | Security Group Management | 0CCE9237-69AE-11D9-BED3-505054503030 |
| 370 | 4758 | Account Management | Security Group Management | 0CCE9237-69AE-11D9-BED3-505054503030 |
| 371 | 4749 | Account Management | Distribution Group Management | 0CCE9238-69AE-11D9-BED3-505054503030 |
| 372 | 4750 | Account Management | Distribution Group Management | 0CCE9238-69AE-11D9-BED3-505054503030 |
| 373 | 4751 | Account Management | Distribution Group Management | 0CCE9238-69AE-11D9-BED3-505054503030 |
| 374 | 4752 | Account Management | Distribution Group Management | 0CCE9238-69AE-11D9-BED3-505054503030 |
| 375 | 4753 | Account Management | Distribution Group Management | 0CCE9238-69AE-11D9-BED3-505054503030 |
| 376 | 4759 | Account Management | Distribution Group Management | 0CCE9238-69AE-11D9-BED3-505054503030 |
| 377 | 4760 | Account Management | Distribution Group Management | 0CCE9238-69AE-11D9-BED3-505054503030 |
| 378 | 4761 | Account Management | Distribution Group Management | 0CCE9238-69AE-11D9-BED3-505054503030 |
| 379 | 4762 | Account Management | Distribution Group Management | 0CCE9238-69AE-11D9-BED3-505054503030 |
| 380 | 4763 | Account Management | Distribution Group Management | 0CCE9238-69AE-11D9-BED3-505054503030 |
| 381 | 4744 | Account Management | Distribution Group Management | 0CCE9238-69AE-11D9-BED3-505054503030 |
| 382 | 4745 | Account Management | Distribution Group Management | 0CCE9238-69AE-11D9-BED3-505054503030 |
| 383 | 4746 | Account Management | Distribution Group Management | 0CCE9238-69AE-11D9-BED3-505054503030 |
| 384 | 4747 | Account Management | Distribution Group Management | 0CCE9238-69AE-11D9-BED3-505054503030 |
| 385 | 4748 | Account Management | Distribution Group Management | 0CCE9238-69AE-11D9-BED3-505054503030 |
| 386 | 4783 | Account Management | Application Group Management | 0CCE9239-69AE-11D9-BED3-505054503030 |
| 387 | 4784 | Account Management | Application Group Management | 0CCE9239-69AE-11D9-BED3-505054503030 |
| 388 | 4785 | Account Management | Application Group Management | 0CCE9239-69AE-11D9-BED3-505054503030 |
| 389 | 4786 | Account Management | Application Group Management | 0CCE9239-69AE-11D9-BED3-505054503030 |
| 390 | 4787 | Account Management | Application Group Management | 0CCE9239-69AE-11D9-BED3-505054503030 |
| 391 | 4788 | Account Management | Application Group Management | 0CCE9239-69AE-11D9-BED3-505054503030 |
| 392 | 4789 | Account Management | Application Group Management | 0CCE9239-69AE-11D9-BED3-505054503030 |
| 393 | 4790 | Account Management | Application Group Management | 0CCE9239-69AE-11D9-BED3-505054503030 |
| 394 | 4791 | Account Management | Application Group Management | 0CCE9239-69AE-11D9-BED3-505054503030 |
| 395 | 4792 | Account Management | Application Group Management | 0CCE9239-69AE-11D9-BED3-505054503030 |
| 396 | 4782 | Account Management | Other Account Management Events | 0CCE923A-69AE-11D9-BED3-505054503030 |
| 397 | 4793 | Account Management | Other Account Management Events | 0CCE923A-69AE-11D9-BED3-505054503030 |
| 398 | DS Access | 6997984F-797A-11D9-BED3-505054503030 | ||
| 399 | 4662 | DS Access | Directory Service Access | 0CCE923B-69AE-11D9-BED3-505054503030 |
| 400 | 4661 | DS Access | Directory Service Access | 0CCE923B-69AE-11D9-BED3-505054503030 |
| 401 | 4928 | DS Access | Directory Service Changes | 0CCE923C-69AE-11D9-BED3-505054503030 |
| 402 | 4929 | DS Access | Directory Service Changes | 0CCE923C-69AE-11D9-BED3-505054503030 |
| 403 | 4930 | DS Access | Directory Service Changes | 0CCE923C-69AE-11D9-BED3-505054503030 |
| 404 | 4931 | DS Access | Directory Service Changes | 0CCE923C-69AE-11D9-BED3-505054503030 |
| 405 | 4934 | DS Access | Directory Service Changes | 0CCE923C-69AE-11D9-BED3-505054503030 |
| 406 | 4935 | DS Access | Directory Service Changes | 0CCE923C-69AE-11D9-BED3-505054503030 |
| 407 | 4936 | DS Access | Directory Service Changes | 0CCE923C-69AE-11D9-BED3-505054503030 |
| 408 | 4937 | DS Access | Directory Service Changes | 0CCE923C-69AE-11D9-BED3-505054503030 |
| 409 | 5136 | DS Access | Directory Service Changes | 0CCE923C-69AE-11D9-BED3-505054503030 |
| 410 | 5137 | DS Access | Directory Service Changes | 0CCE923C-69AE-11D9-BED3-505054503030 |
| 411 | 5138 | DS Access | Directory Service Changes | 0CCE923C-69AE-11D9-BED3-505054503030 |
| 412 | 5139 | DS Access | Directory Service Changes | 0CCE923C-69AE-11D9-BED3-505054503030 |
| 413 | 5141 | DS Access | Directory Service Changes | 0CCE923C-69AE-11D9-BED3-505054503030 |
| 414 | 4928 | DS Access | Directory Service Replication | 0CCE923D-69AE-11D9-BED3-505054503030 |
| 415 | 4929 | DS Access | Directory Service Replication | 0CCE923D-69AE-11D9-BED3-505054503030 |
| 416 | 4930 | DS Access | Directory Service Replication | 0CCE923D-69AE-11D9-BED3-505054503030 |
| 417 | 4931 | DS Access | Directory Service Replication | 0CCE923D-69AE-11D9-BED3-505054503030 |
| 418 | 4934 | DS Access | Directory Service Replication | 0CCE923D-69AE-11D9-BED3-505054503030 |
| 419 | 4935 | DS Access | Directory Service Replication | 0CCE923D-69AE-11D9-BED3-505054503030 |
| 420 | 4936 | DS Access | Directory Service Replication | 0CCE923D-69AE-11D9-BED3-505054503030 |
| 421 | 4937 | DS Access | Directory Service Replication | 0CCE923D-69AE-11D9-BED3-505054503030 |
| 422 | 4928 | DS Access | Detailed Directory Service Replication | 0CCE923E-69AE-11D9-BED3-505054503030 |
| 423 | 4929 | DS Access | Detailed Directory Service Replication | 0CCE923E-69AE-11D9-BED3-505054503030 |
| 424 | 4930 | DS Access | Detailed Directory Service Replication | 0CCE923E-69AE-11D9-BED3-505054503030 |
| 425 | 4931 | DS Access | Detailed Directory Service Replication | 0CCE923E-69AE-11D9-BED3-505054503030 |
| 426 | 4934 | DS Access | Detailed Directory Service Replication | 0CCE923E-69AE-11D9-BED3-505054503030 |
| 427 | 4935 | DS Access | Detailed Directory Service Replication | 0CCE923E-69AE-11D9-BED3-505054503030 |
| 428 | 4936 | DS Access | Detailed Directory Service Replication | 0CCE923E-69AE-11D9-BED3-505054503030 |
| 429 | 4937 | DS Access | Detailed Directory Service Replication | 0CCE923E-69AE-11D9-BED3-505054503030 |
| 430 | Account Logon | 69979850-797A-11D9-BED3-505054503030 | ||
| 431 | 4776 | Account Logon | Credential Validation | 0CCE923F-69AE-11D9-BED3-505054503030 |
| 432 | 4769 | Account Logon | Kerberos Service Ticket Operations | 0CCE9240-69AE-11D9-BED3-505054503030 |
| 433 | 4770 | Account Logon | Kerberos Service Ticket Operations | 0CCE9240-69AE-11D9-BED3-505054503030 |
| 434 | 4773 | Account Logon | Kerberos Service Ticket Operations | 0CCE9240-69AE-11D9-BED3-505054503030 |
| 435 | Account Logon | Other Account Logon Events | 0CCE9241-69AE-11D9-BED3-505054503030 | |
| 436 | 4768 | Account Logon | Kerberos Authentication Service | 0CCE9242-69AE-11D9-BED3-505054503030 |
| 437 | 4771 | Account Logon | Kerberos Authentication Service | 0CCE9242-69AE-11D9-BED3-505054503030 |
| 438 | 4772 | Account Logon | Kerberos Authentication Service | 0CCE9242-69AE-11D9-BED3-505054503030 |