参考微软文档整理的常用EVENTID：
| Event ID | Event message | 分類 | 類別 |
| 4670 | Permissions on an object were changed. | Audit Other Policy Change Events | Policy Change |
| 4704 | A user right was assigned. | Audit Authorization Policy Change | Policy Change |
| 4705 | A user right was removed. | Audit Authorization Policy Change | Policy Change |
| 4706 | A new trust was created to a domain. | Audit Authorization Policy Change | Policy Change |
| 4707 | A trust to a domain was removed. | Audit Authorization Policy Change | Policy Change |
| 4709 | IPsec Services was started. | Audit Filtering Platform Policy Change | Policy Change |
| 4710 | IPsec Services was disabled. | Audit Filtering Platform Policy Change | Policy Change |
| 4711 | May contain any one of the following:PAStore Engine applied locally cached copy of Active Directory storage IPsec policy on the computer. | Audit Filtering Platform Policy Change | Policy Change |
| 4712 | IPsec Services encountered a potentially serious failure. | Audit Filtering Platform Policy Change | Policy Change |
| 4713 | Kerberos policy was changed. | Audit Authentication Policy Change | Policy Change |
| 4714 | Encrypted data recovery policy was changed. | Audit Authorization Policy Change | Policy Change |
| 4715 | The audit policy (SACL) on an object was changed. | Audit Audit Policy Change | Policy Change |
| 4716 | Trusted domain information was modified. | Audit Authentication Policy Change | Policy Change |
| 4717 | System security access was granted to an account. | Audit Authentication Policy Change | Policy Change |
| 4718 | System security access was removed from an account. | Audit Authentication Policy Change | Policy Change |
| 4719 | System audit policy was changed. | Audit Audit Policy Change | Policy Change |
| 4720 | A user account was created. | Audit User | Account Management |
| 4722 | A user account was enabled. | Audit User | Account Management |
| 4723 | An attempt was made to change an account's password. | Audit User | Account Management |
| 4724 | An attempt was made to reset an account's password. | Audit User | Account Management |
| 4725 | A user account was disabled. | Audit User | Account Management |
| 4726 | A user account was deleted. | Audit User | Account Management |
| 4727 | A security-enabled global group was created. | Audit Security Group | Account Management |
| 4728 | A member was added to a security-enabled global group. | Audit Security Group | Account Management |
| 4729 | A member was removed from a security-enabled global group. | Audit Security Group | Account Management |
| 4730 | A security-enabled global group was deleted. | Audit Security Group | Account Management |
| 4731 | A security-enabled local group was created. | Audit Security Group | Account Management |
| 4732 | A member was added to a security-enabled local group. | Audit Security Group | Account Management |
| 4733 | A member was removed from a security-enabled local group. | Audit Security Group | Account Management |
| 4734 | A security-enabled local group was deleted. | Audit Security Group | Account Management |
| 4735 | A security-enabled local group was changed. | Audit Security Group | Account Management |
| 4737 | A security-enabled global group was changed. | Audit Security Group | Account Management |
| 4738 | A user account was changed. | Audit User | Account Management |
| 4739 | Domain Policy was changed. | Audit Authentication Policy Change | Policy Change |
| 4740 | A user account was locked out. | Audit User | Account Management |
| 4741 | A computer account was created. | Audit Computer | Account Management |
| 4742 | A computer account was changed. | Audit Computer | Account Management |
| 4743 | A computer account was deleted. | Audit Computer | Account Management |
| 4744 | A security-disabled local group was created. | Audit Distribution Group | Account Management |
| 4745 | A security-disabled local group was changed. | Audit Distribution Group | Account Management |
| 4746 | A member was added to a security-disabled local group. | Audit Distribution Group | Account Management |
| 4747 | A member was removed from a security-disabled local group. | Audit Distribution Group | Account Management |
| 4748 | A security-disabled local group was deleted. | Audit Distribution Group | Account Management |
| 4749 | A security-disabled global group was created. | Audit Distribution Group | Account Management |
| 4750 | A security-disabled global group was changed. | Audit Distribution Group | Account Management |
| 4751 | A member was added to a security-disabled global group. | Audit Distribution Group | Account Management |
| 4752 | A member was removed from a security-disabled global group. | Audit Distribution Group | Account Management |
| 4753 | A security-disabled global group was deleted. | Audit Distribution Group | Account Management |
| 4754 | A security-enabled universal group was created. | Audit Security Group | Account Management |
| 4755 | A security-enabled universal group was changed. | Audit Security Group | Account Management |
| 4756 | A member was added to a security-enabled universal group. | Audit Security Group | Account Management |
| 4757 | A member was removed from a security-enabled universal group. | Audit Security Group | Account Management |
| 4758 | A security-enabled universal group was deleted. | Audit Security Group | Account Management |
| 4759 | A security-disabled universal group was created. | Audit Distribution Group | Account Management |
| 4760 | A security-disabled universal group was changed. | Audit Distribution Group | Account Management |
| 4761 | A member was added to a security-disabled universal group. | Audit Distribution Group | Account Management |
| 4762 | A member was removed from a security-disabled universal group. | Audit Distribution Group | Account Management |
| 4764 | A group's type was changed. | Audit Security Group | Account Management |
| 4765 | SID History was added to an account. | Audit User | Account Management |
| 4766 | An attempt to add SID History to an account failed. | Audit User | Account Management |
| 4767 | A user account was unlocked. | Audit User | Account Management |
| 4780 | The ACL was set on accounts which are members of administrators groups. | Audit User | Account Management |
| 4781 | The name of an account was changed: | Audit User | Account Management |
| 4782 | The password hash for an account was accessed. | Audit Other Account | Account Management |
| 4783 | A basic application group was created. | Audit Application Group | Account Management |
| 4784 | A basic application group was changed. | Audit Application Group | Account Management |
| 4785 | A member was added to a basic application group. | Audit Application Group | Account Management |
| 4786 | A member was removed from a basic application group. | Audit Application Group | Account Management |
| 4787 | A non-member was added to a basic application group. | Audit Application Group | Account Management |
| 4788 | A non-member was removed from a basic application group. | Audit Application Group | Account Management |
| 4789 | A basic application group was deleted. | Audit Application Group | Account Management |
| 4790 | An LDAP query group was created. | Audit Application Group | Account Management |
| 4793 | The Password Policy Checking API was called. | Audit Other Account | Account Management |
| 4794 | An attempt was made to set the Directory Services Restore Mode. | Audit User | Account Management |
| 4817 | Auditing settings on an object were changed. | Audit Audit Policy Change | Policy Change |
| 4864 | A namespace collision was detected. | Audit Authentication Policy Change | Policy Change |
| 4865 | A trusted forest information entry was added. | Audit Authentication Policy Change | Policy Change |
| 4866 | A trusted forest information entry was removed. | Audit Authentication Policy Change | Policy Change |
| 4867 | A trusted forest information entry was modified. | Audit Authentication Policy Change | Policy Change |
| 4902 | The Per-user audit policy table was created. | Audit Audit Policy Change | Policy Change |
| 4904 | An attempt was made to register a security event source. | Audit Audit Policy Change | Policy Change |
| 4905 | An attempt was made to unregister a security event source. | Audit Audit Policy Change | Policy Change |
| 4906 | The CrashOnAuditFail value has changed. | Audit Audit Policy Change | Policy Change |
| 4907 | Auditing settings on object were changed. | Audit Audit Policy Change | Policy Change |
| 4908 | Special Groups Logon table modified. | Audit Audit Policy Change | Policy Change |
| 4909 | The local policy settings for the TBS were changed. | Audit Other Policy Change Events | Policy Change |
| 4910 | The group policy settings for the TBS were changed. | Audit Other Policy Change Events | Policy Change |
| 4912 | Per User Audit Policy was changed. | Audit Audit Policy Change | Policy Change |
| 4944 | The following policy was active when the Windows Firewall started. | Audit MPSSVC Rule-Level Policy Change | Policy Change |
| 4945 | A rule was listed when the Windows Firewall started. | Audit MPSSVC Rule-Level Policy Change | Policy Change |
| 4946 | A change has been made to Windows Firewall exception list. A rule was added. | Audit MPSSVC Rule-Level Policy Change | Policy Change |
| 4947 | A change has been made to Windows Firewall exception list. A rule was modified. | Audit MPSSVC Rule-Level Policy Change | Policy Change |
| 4948 | A change has been made to Windows Firewall exception list. A rule was deleted. | Audit MPSSVC Rule-Level Policy Change | Policy Change |
| 4949 | Windows Firewall settings were restored to the default values. | Audit MPSSVC Rule-Level Policy Change | Policy Change |
| 4950 | A Windows Firewall setting has changed. | Audit MPSSVC Rule-Level Policy Change | Policy Change |
| 4951 | A rule has been ignored because its major version number was not recognized by Windows Firewall. | Audit MPSSVC Rule-Level Policy Change | Policy Change |
| 4952 | Parts of a rule have been ignored because its minor version number was not recognized by Windows Firewall. The other parts of the rule will be enforced. | Audit MPSSVC Rule-Level Policy Change | Policy Change |
| 4953 | A rule has been ignored by Windows Firewall because it could not parse the rule. | Audit MPSSVC Rule-Level Policy Change | Policy Change |
| 4954 | Windows Firewall Group Policy settings have changed. The new settings have been applied. | Audit MPSSVC Rule-Level Policy Change | Policy Change |
| 4956 | Windows Firewall has changed the active profile. | Audit MPSSVC Rule-Level Policy Change | Policy Change |
| 4957 | Windows Firewall did not apply the following rule: | Audit MPSSVC Rule-Level Policy Change | Policy Change |
| 4958 | Windows Firewall did not apply the following rule because the rule referred to items not configured on this computer: | Audit MPSSVC Rule-Level Policy Change | Policy Change |
| 5040 | A change has been made to IPsec settings. An Authentication Set was added. | Audit Filtering Platform Policy Change | Policy Change |
| 5041 | A change has been made to IPsec settings. An Authentication Set was modified. | Audit Filtering Platform Policy Change | Policy Change |
| 5042 | A change has been made to IPsec settings. An Authentication Set was deleted. | Audit Filtering Platform Policy Change | Policy Change |
| 5043 | A change has been made to IPsec settings. A Connection Security Rule was added. | Audit Filtering Platform Policy Change | Policy Change |
| 5044 | A change has been made to IPsec settings. A Connection Security Rule was modified. | Audit Filtering Platform Policy Change | Policy Change |
| 5045 | A change has been made to IPsec settings. A Connection Security Rule was deleted. | Audit Filtering Platform Policy Change | Policy Change |
| 5046 | A change has been made to IPsec settings. A Crypto Set was added. | Audit Filtering Platform Policy Change | Policy Change |
| 5047 | A change has been made to IPsec settings. A Crypto Set was modified. | Audit Filtering Platform Policy Change | Policy Change |
| 5048 | A change has been made to IPsec settings. A Crypto Set was deleted. | Audit Filtering Platform Policy Change | Policy Change |
| 5063 | A cryptographic provider operation was attempted. | Audit Other Policy Change Events | Policy Change |
| 5064 | A cryptographic context operation was attempted. | Audit Other Policy Change Events | Policy Change |
| 5065 | A cryptographic context modification was attempted. | Audit Other Policy Change Events | Policy Change |
| 5066 | A cryptographic function operation was attempted. | Audit Other Policy Change Events | Policy Change |
| 5067 | A cryptographic function modification was attempted. | Audit Other Policy Change Events | Policy Change |
| 5068 | A cryptographic function provider operation was attempted. | Audit Other Policy Change Events | Policy Change |
| 5069 | A cryptographic function property operation was attempted. | Audit Other Policy Change Events | Policy Change |
| 5070 | A cryptographic function property modification was attempted. | Audit Other Policy Change Events | Policy Change |
| 5376 | Credential Manager credentials were backed up. | Audit User | Account Management |
| 5377 | Credential Manager credentials were restored from a backup. | Audit User | Account Management |
| 5440 | The following callout was present when the Windows Filtering Platform Base Filtering Engine started. | Audit Filtering Platform Policy Change | Policy Change |
| 5441 | The following filter was present when the Windows Filtering Platform Base Filtering Engine started. | Audit Filtering Platform Policy Change | Policy Change |
| 5442 | The following provider was present when the Windows Filtering Platform Base Filtering Engine started. | Audit Filtering Platform Policy Change | Policy Change |
| 5443 | The following provider context was present when the Windows Filtering Platform Base Filtering Engine started. | Audit Filtering Platform Policy Change | Policy Change |
| 5444 | The following sub-layer was present when the Windows Filtering Platform Base Filtering Engine started. | Audit Filtering Platform Policy Change | Policy Change |
| 5446 | A Windows Filtering Platform callout has been changed. | Audit Filtering Platform Policy Change | Policy Change |
| 5447 | A Windows Filtering Platform filter has been changed. | Audit Other Policy Change Events | Policy Change |
| 5448 | A Windows Filtering Platform provider has been changed. | Audit Filtering Platform Policy Change | Policy Change |
| 5449 | A Windows Filtering Platform provider context has been changed. | Audit Filtering Platform Policy Change | Policy Change |
| 5450 | A Windows Filtering Platform sub-layer has been changed. | Audit Filtering Platform Policy Change | Policy Change |
| 5456 | PAStore Engine applied Active Directory storage IPsec policy on the computer. | Audit Filtering Platform Policy Change | Policy Change |
| 5457 | PAStore Engine failed to apply Active Directory storage IPsec policy on the computer. | Audit Filtering Platform Policy Change | Policy Change |
| 5458 | PAStore Engine applied locally cached copy of Active Directory storage IPsec policy on the computer. | Audit Filtering Platform Policy Change | Policy Change |
| 5459 | PAStore Engine failed to apply locally cached copy of Active Directory storage IPsec policy on the computer. | Audit Filtering Platform Policy Change | Policy Change |
| 5460 | PAStore Engine applied local registry storage IPsec policy on the computer. | Audit Filtering Platform Policy Change | Policy Change |
| 5461 | PAStore Engine failed to apply local registry storage IPsec policy on the computer. | Audit Filtering Platform Policy Change | Policy Change |
| 5462 | PAStore Engine failed to apply some rules of the active IPsec policy on the computer. Use the IP Security Monitor snap-in to diagnose the problem. | Audit Filtering Platform Policy Change | Policy Change |
| 5463 | PAStore Engine polled for changes to the active IPsec policy and detected no changes. | Audit Filtering Platform Policy Change | Policy Change |
| 5464 | PAStore Engine polled for changes to the active IPsec policy, detected changes, and applied them to IPsec Services. | Audit Filtering Platform Policy Change | Policy Change |
| 5465 | PAStore Engine received a control for forced reloading of IPsec policy and processed the control successfully. | Audit Filtering Platform Policy Change | Policy Change |
| 5466 | PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory cannot be reached, and will use the cached copy of the Active Directory IPsec policy instead. Any changes made to the Active Directory IPsec policy since the last poll could not be applied. | Audit Filtering Platform Policy Change | Policy Change |
| 5467 | PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, and found no changes to the policy. The cached copy of the Active Directory IPsec policy is no longer being used. | Audit Filtering Platform Policy Change | Policy Change |
| 5468 | PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, found changes to the policy, and applied those changes. The cached copy of the Active Directory IPsec policy is no longer being used. | Audit Filtering Platform Policy Change | Policy Change |
| 5471 | PAStore Engine loaded local storage IPsec policy on the computer. | Audit Filtering Platform Policy Change | Policy Change |
| 5472 | PAStore Engine failed to load local storage IPsec policy on the computer. | Audit Filtering Platform Policy Change | Policy Change |
| 5473 | PAStore Engine loaded directory storage IPsec policy on the computer. | Audit Filtering Platform Policy Change | Policy Change |
| 5474 | PAStore Engine failed to load directory storage IPsec policy on the computer. | Audit Filtering Platform Policy Change | Policy Change |
| 5477 | PAStore Engine failed to add quick mode filter. | Audit Filtering Platform Policy Change | Policy Change |
| 6144 | Security policy in the group policy objects has been applied successfully. | Audit Other Policy Change Events | Policy Change |
| 6145 | One or more errors occurred while processing security policy in the group policy objects. | Audit Other Policy Change Events | Policy Change |