| Sr no |
Event ID 2003 Server |
Event ID 2008 Server |
Event Type |
| 1 |
528 |
4624 |
Local User logon |
| 2 |
6008 |
6008 |
Unexpected Shutdown |
| 3 |
6009 |
6009 |
Logged During every boot |
| 4 |
6006 |
6006 |
Clean Shutdown |
| 5 |
624 |
4720 |
Local account created |
| 6 |
630 |
4726 |
Local account deleted |
| 7 |
7036 |
7036 |
DHCP Server Service Start |
| 8 |
7035 |
7035 |
DHCP Server Service Stop |
| 9 |
3 |
3 |
DNS Server Shutdown |
| 10 |
2 |
2 |
DNS Server Start |
| 11 |
|
4777 |
The Domain Controller failed to validate the credential |
| 12 |
576 |
4672 |
Special privilages assigned to new logon |
| 13 |
578 |
4674 |
An operation was attempted on a privileged object |
| 14 |
520 |
4616 |
The system time was changed |
| 15 |
608 |
4704 |
A user right was assigned |
| 16 |
609 |
4705 |
A user Rights was removed |
| 17 |
567 |
4657 |
A registry value was modified |
| 18 |
564 |
4660 |
An object was deleted |
| 19 |
643 |
4739 |
Domain policy was changed |
| 20 |
644 |
4740 |
A user account was locked out |
| 21 |
685 |
4781 |
The name of the account was changed
|