538 | User logoff | This event does not necessarily indicate the time that the user stopped using the computer. For example, if the user turns the computer off without first logging off, or if the network connection to a share breaks, the computer might not record a logoff at all, or might record a logoff only when the computer notices that the connection is broken. |
551 | User initiates logoff | Use Event 538, which confirms logoff instead. |
562 | A handle to an object closed | Always records a success. |
571 | Client Context deleted by Authorization Manager. | Normal where Authorization Manager is in use. |
573 | Process generates nonsystem audit event with Authorization Application Programming Interface (AuthZ API) | Typical behavior. |
577 578 | Privilege service called, privileged object operation | These high volume events typically do not contain enough information either to understand what happened or to act upon them. |
594 | A handle to an object was duplicated | Typical behavior. |
595 | Indirect access to an object was obtained | Typical behavior. |
596 | Backup of data protection master key | Occurs automatically every 90 days with default settings. |
597 | Recovery of data protection master key | Typical behavior. |
624 642 | Event 624 where User equals System, followed by 642 where Target Account Name equals IUSR_machinename or IWAM_machinename and Caller User Name equals machinename$ . | This event sequence indicates that an administrator has installed IIS on the computer. |
624 630 642 | User equals System and all three events have same time-stamp and New/Target Account Name equals HelpAssistant and Caller User Name equals DCname$ | This sequence is generated when an administrator installs Active Directory on a computer that runs Windows Server 2003. |
624 or 642 | User equals ExchangeServername$ and Target Account Name is a Globally Unique Identifier (GUID) | This event occurs when an Exchange Server first comes online and automatically generates system mailboxes. |
624 | Caller User Name is any user and New Account Name is machinename$ | A user in the domain has created or connected a new computer account in the domain. This event is acceptable if users have the right to join computers to a domain; otherwise you should investigate this event. |
627 | User equals System and Target Account Name equals TsInternetUser and Caller User Name is usually DCname$ | These events result from the normal behavior of a computer that runs Terminal Services. |
672 | Kerberos AS Ticket request | If you collect logon events 528 and 540 from all computers, event 672 might not contain any additional useful information, as it just records that a Kerberos TGT was granted. There must still be a service ticket granted (event 673) for any access to occur. |
680 | Account Logon | If you collecting logon events 528 and 540 from all computers, event 680 might not contain any additional useful information, because it just records validation of the account credentials. A separate logon event records what the user accessed. |
697 | Password policy checking API called | Typical behavior. |
768 | Forest namespace collision | Not security related. |
769 770 771 | Trusted forest information added, deleted or modified | These events indicate normal operation of inter-forest trusts. You should not confuse these with addition, deletion, or modification of the trust itself. |
832 to 841 | Various Active Directory replication issues | No security implications. |
