| Date and time | Source | Type | ID | Description |
| 09/01/2004 | 14:26:08 | Security | Failure Audit | 598 | Protection of auditable protected data. Data Description: Key Identifier: Protected Data Flags: 0x0 Protection Algorithms: 3DES-168 , SHA1-160 Failure Reason: 0x2 |
| 09/01/2004 | 14:26:00 | Security | Failure Audit | 598 | Protection of auditable protected data. Data Description: Key Identifier: Protected Data Flags: 0x0 Protection Algorithms: 3DES-168 , SHA1-160 Failure Reason: 0x2 |
| 09/01/2004 | 14:25:41 | Security | Failure Audit | 598 | Protection of auditable protected data. Data Description: Key Identifier: Protected Data Flags: 0x0 Protection Algorithms: 3DES-168 , SHA1-160 Failure Reason: 0x2 |
| 09/01/2004 | 13:13:03 | Security | Failure Audit | 598 | Protection of auditable protected data. Data Description: Key Identifier: Protected Data Flags: 0x0 Protection Algorithms: 3DES-168 , SHA1-160 Failure Reason: 0x2 |
| 09/01/2004 | 13:12:55 | Security | Failure Audit | 598 | Protection of auditable protected data. Data Description: Key Identifier: Protected Data Flags: 0x0 Protection Algorithms: 3DES-168 , SHA1-160 Failure Reason: 0x2 |
| 09/01/2004 | 13:12:01 | Security | Failure Audit | 598 | Protection of auditable protected data. Data Description: Key Identifier: Protected Data Flags: 0x0 Protection Algorithms: 3DES-168 , SHA1-160 Failure Reason: 0x2 |
| 09/01/2004 | 13:11:02 | Security | Failure Audit | 598 | Protection of auditable protected data. Data Description: Key Identifier: Protected Data Flags: 0x0 Protection Algorithms: 3DES-168 , SHA1-160 Failure Reason: 0x2 |
| 09/01/2004 | 13:10:45 | Security | Failure Audit | 598 | Protection of auditable protected data. Data Description: Key Identifier: Protected Data Flags: 0x0 Protection Algorithms: 3DES-168 , SHA1-160 Failure Reason: 0x2 |
| 09/01/2004 | 13:10:01 | Security | Failure Audit | 598 | Protection of auditable protected data. Data Description: Key Identifier: Protected Data Flags: 0x0 Protection Algorithms: 3DES-168 , SHA1-160 Failure Reason: 0x2 |
| 09/01/2004 | 13:01:12 | Security | Failure Audit | 598 | Protection of auditable protected data. Data Description: Key Identifier: Protected Data Flags: 0x0 Protection Algorithms: 3DES-168 , SHA1-160 Failure Reason: 0x2 |
| 09/01/2004 | 13:01:06 | Security | Failure Audit | 598 | Protection of auditable protected data. Data Description: Key Identifier: Protected Data Flags: 0x0 Protection Algorithms: 3DES-168 , SHA1-160 Failure Reason: 0x2 |
| 09/01/2004 | 13:01:06 | Security | Failure Audit | 598 | Protection of auditable protected data. Data Description: Key Identifier: Protected Data Flags: 0x0 Protection Algorithms: 3DES-168 , SHA1-160 Failure Reason: 0x2 |
| 09/01/2004 | 13:01:05 | Security | Failure Audit | 598 | Protection of auditable protected data. Data Description: Enterprise Credential Set Key Identifier: Protected Data Flags: 0x20000000 Protection Algorithms: 3DES-168 , SHA1-160 Failure Reason: 0x2 |
| 09/01/2004 | 13:01:05 | Security | Failure Audit | 598 | Protection of auditable protected data. Data Description: Key Identifier: Protected Data Flags: 0x0 Protection Algorithms: 3DES-168 , SHA1-160 Failure Reason: 0x2 |
| 09/01/2004 | 13:00:56 | Security | Failure Audit | 598 | Protection of auditable protected data. Data Description: Key Identifier: Protected Data Flags: 0x0 Protection Algorithms: 3DES-168 , SHA1-160 Failure Reason: 0x2 |
| 09/01/2004 | 11:19:22 | Security | Failure Audit | 598 | Protection of auditable protected data. Data Description: Enterprise Credential Set Key Identifier: Protected Data Flags: 0x20000000 Protection Algorithms: 3DES-168 , SHA1-160 Failure Reason: 0x2 |
| 09/01/2004 | 11:13:48 | Security | Failure Audit | 598 | Protection of auditable protected data. Data Description: Key Identifier: Protected Data Flags: 0x0 Protection Algorithms: 3DES-168 , SHA1-160 Failure Reason: 0x2 |
| 09/01/2004 | 11:13:48 | Security | Failure Audit | 598 | Protection of auditable protected data. Data Description: Key Identifier: Protected Data Flags: 0x0 Protection Algorithms: 3DES-168 , SHA1-160 Failure Reason: 0x2 |
| 09/01/2004 | 11:13:42 | Security | Failure Audit | 599 | Unprotection of auditable protected data. Data Description: Enterprise Credential Set Key Identifier: 46f0e4e0-0056-4dcf-8f48-04c53e1a698d Protected Data Flags: 0x0 Protection Algorithms: 3DES-168 , SHA1-160 Failure Reason: 0x2 |
| 09/01/2004 | 11:13:41 | Security | Failure Audit | 680 | Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Logon account: asmith@acme.local Source Workstation: EMACHINE 0xC0000064 |
| 09/01/2004 | 10:58:10 | Security | Failure Audit | 615 | IPSec Services: IPSec Services failed to get the complete list of network interfaces on the machine. This can be a potential security hazard to the machine since some of the network interfaces may not get the protection as desired by the applied IPSec filters. Please run IPSec monitor snap-in to further diagnose the problem. |
| 09/01/2004 | 12:29:57 | Security | Success Audit | 528 | Successful Logon: User Name: NETWORK SERVICE Domain: NT AUTHORITY Logon ID: (0x0,0xnnnn) Logon type: Logon Type: 5 Logon Process: Advapi Authentication Package: Negotiate Workstation Name: Logon GUID: {00000000-0000-0000-0000-000000000000} |
| 09/01/2004 | 11:38:18 | Security | Success Audit | 515 | A trusted logon process has registered with the Local Security Authority. This logon process will be trusted to submit logon requests. Logon Process Name: KSecDD |
| 09/01/2004 | 11:13:50 | Security | Success Audit | 528 | Successful Logon: User Name: LOCAL SERVICE Domain: NT AUTHORITY Logon ID: (0x0,0xnnnn) Logon type: Logon Type: 5 Logon Process: Advapi Authentication Package: Negotiate Workstation Name: Logon GUID: {00000000-0000-0000-0000-000000000000} |
| 09/01/2004 | 11:13:41 | Security | Success Audit | 528 | Successful Logon: User Name: asmith Domain: acme Logon ID: (0x0,0xnnnn) Logon type: Logon Type: 2 Logon Process: User32 Authentication Package: Negotiate Workstation Name: EMACHINE Logon GUID: {00000000-0000-0000-0000-000000000000} |
| 09/01/2004 | 11:13:39 | Security | Success Audit | 528 | Successful Logon: User Name: asmith Domain: acme Logon ID: (0x0,0xnnnn) Logon type: Logon Type: 11 Logon Process: User32 Authentication Package: Negotiate Workstation Name: EMACHINE Logon GUID: {00000000-0000-0000-0000-000000000000} |
| 09/01/2004 | 11:13:39 | Security | Success Audit | 538 | User Logoff: User Name: asmith Domain: acme Logon ID: (0x0,0xnnnn) Logon type: Logon Type: 11 |
| 09/01/2004 | 10:53:14 | Security | Success Audit | 528 | Successful Logon: User Name: NETWORK SERVICE Domain: NT AUTHORITY Logon ID: (0x0,0xnnnn) Logon type: Logon Type: 5 Logon Process: Advapi Authentication Package: Negotiate Workstation Name: Logon GUID: {00000000-0000-0000-0000-000000000000} |
| 09/01/2004 | 10:52:12 | Security | Success Audit | 629 | User Account Disabled: Target Account Name: HelpAssistant Target Domain: EMACHINE Target Account ID: %{S-1-5-21-1563972592-4232377176-2666036622-1004} Caller User Name: EMACHINE$ Caller Domain: acme Caller Logon ID: (0x0,0x3E7) |
| 09/01/2004 | 10:52:11 | Security | Success Audit | 540 | Successful Network Logon: User Name: HelpAssistant Domain: EMACHINE Logon ID: (0x0,0xnnnn) Logon type: Logon Type: 8 Logon Process: Advapi Authentication Package: Negotiate Workstation Name: EMACHINE Logon GUID: {00000000-0000-0000-0000-000000000000} |
| 09/01/2004 | 10:52:11 | Security | Success Audit | 609 | User Right Removed: User Right: - Removed From: %{S-1-5-21-1563972592-4232377176-2666036622-1004} Removed By: User Name: EMACHINE$ Domain: acme Logon ID: (0x0,0x3E7) |
| 09/01/2004 | 10:52:11 | Security | Success Audit | 538 | User Logoff: User Name: HelpAssistant Domain: EMACHINE Logon ID: (0x0,0xnnnn) Logon type: Logon Type: 8 |
| 09/01/2004 | 10:52:11 | Security | Success Audit | 680 | Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Logon account: HelpAssistant Source Workstation: EMACHINE 0x0 |
| 09/01/2004 | 10:52:11 | Security | Success Audit | 622 | System Security Access Removed: Access Removed: SeNetworkLogonRight Account Modified: %{S-1-5-21-1563972592-4232377176-2666036622-1004} Removed By: User Name: EMACHINE$ Domain: acme Logon ID: (0x0,0xnnnn) |
| 09/01/2004 | 10:52:09 | Security | Success Audit | 515 | A trusted logon process has registered with the Local Security Authority. This logon process will be trusted to submit logon requests. Logon Process Name: RASMAN |
| 09/01/2004 | 10:52:07 | Security | Success Audit | 621 | System Security Access Granted: Access Granted: SeNetworkLogonRight Account Modified: %{S-1-5-21-1563972592-4232377176-2666036622-1004} Assigned By: User Name: EMACHINE$ Domain: acme Logon ID: (0x0,0xnnnn) |
| 09/01/2004 | 10:52:07 | Security | Success Audit | 626 | User Account Enabled: Target Account Name: HelpAssistant Target Domain: EMACHINE Target Account ID: %{S-1-5-21-1563972592-4232377176-2666036622-1004} Caller User Name: EMACHINE$ Caller Domain: acme Caller Logon ID: (0x0,0x3E7) |
| 09/01/2004 | 10:52:07 | Security | Success Audit | 528 | Successful Logon: User Name: LOCAL SERVICE Domain: NT AUTHORITY Logon ID: (0x0,0xnnnn) Logon type: Logon Type: 5 Logon Process: Advapi Authentication Package: Negotiate Workstation Name: Logon GUID: {00000000-0000-0000-0000-000000000000} |
| 09/01/2004 | 10:52:04 | Security | Success Audit | 540 | Successful Network Logon: User Name: Domain: Logon ID: (0x0,0xnnnn) Logon type: Logon Type: 3 Logon Process: NtLmSsp Authentication Package: NTLM Workstation Name: Logon GUID: {00000000-0000-0000-0000-000000000000} |
| 09/01/2004 | 10:52:04 | Security | Success Audit | 615 | IPSec Services: IPSec Services has started successfully. |
| 09/01/2004 | 10:52:03 | Security | Success Audit | 528 | Successful Logon: User Name: LOCAL SERVICE Domain: NT AUTHORITY Logon ID: (0x0,0xnnnn) Logon type: Logon Type: 5 Logon Process: Advapi Authentication Package: Negotiate Workstation Name: Logon GUID: {00000000-0000-0000-0000-000000000000} |
| 09/01/2004 | 10:52:03 | Security | Success Audit | 528 | Successful Logon: User Name: LOCAL SERVICE Domain: NT AUTHORITY Logon ID: (0x0,0xnnnn) Logon type: Logon Type: 5 Logon Process: Advapi Authentication Package: Negotiate Workstation Name: Logon GUID: {00000000-0000-0000-0000-000000000000} |
| 09/01/2004 | 10:51:47 | Security | Success Audit | 515 | A trusted logon process has registered with the Local Security Authority. This logon process will be trusted to submit logon requests. Logon Process Name: LAN Manager Workstation Service |
| 09/01/2004 | 10:51:47 | Security | Success Audit | 515 | A trusted logon process has registered with the Local Security Authority. This logon process will be trusted to submit logon requests. Logon Process Name: CHAP |
| 09/01/2004 | 10:51:47 | Security | Success Audit | 528 | Successful Logon: User Name: LOCAL SERVICE Domain: NT AUTHORITY Logon ID: (0x0,0xnnnn) Logon type: Logon Type: 5 Logon Process: Advapi Authentication Package: Negotiate Workstation Name: Logon GUID: {00000000-0000-0000-0000-000000000000} |
| 09/01/2004 | 10:51:46 | Security | Success Audit | 518 | An notification package has been loaded by the Security Account Manager. This package will be notified of any account or password changes. Notification Package Name: scecli |
| 09/01/2004 | 10:51:46 | Security | Success Audit | 515 | A trusted logon process has registered with the Local Security Authority. This logon process will be trusted to submit logon requests. Logon Process Name: KSecDD |
| 09/01/2004 | 10:51:46 | Security | Success Audit | 514 | An authentication package has been loaded by the Local Security Authority. This authentication package will be used to authenticate logon attempts. Authentication Package Name: C:\WINDOWS\system32\kerberos.dll : Kerberos |
| 09/01/2004 | 10:51:46 | Security | Success Audit | 515 | A trusted logon process has registered with the Local Security Authority. This logon process will be trusted to submit logon requests. Logon Process Name: KSecDD |
| 09/01/2004 | 10:51:46 | Security | Success Audit | 514 | An authentication package has been loaded by the Local Security Authority. This authentication package will be used to authenticate logon attempts. Authentication Package Name: C:\WINDOWS\system32\msv1_0.dll : MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 |
| 09/01/2004 | 10:51:46 | Security | Success Audit | 514 | An authentication package has been loaded by the Local Security Authority. This authentication package will be used to authenticate logon attempts. Authentication Package Name: C:\WINDOWS\system32\LSASRV.dll : Negotiate |
| 09/01/2004 | 10:51:46 | Security | Success Audit | 515 | A trusted logon process has registered with the Local Security Authority. This logon process will be trusted to submit logon requests. Logon Process Name: Winlogon |
| 09/01/2004 | 10:51:46 | Security | Success Audit | 528 | Successful Logon: User Name: NETWORK SERVICE Domain: NT AUTHORITY Logon ID: (0x0,0xnnnn) Logon type: Logon Type: 5 Logon Process: Advapi Authentication Package: Negotiate Workstation Name: Logon GUID: {00000000-0000-0000-0000-000000000000} |
| 09/01/2004 | 10:51:46 | Security | Success Audit | 514 | An authentication package has been loaded by the Local Security Authority. This authentication package will be used to authenticate logon attempts. Authentication Package Name: C:\WINDOWS\system32\msv1_0.dll : NTLM |
| 09/01/2004 | 10:51:46 | Security | Success Audit | 512 | Windows is starting up. |
| 09/01/2004 | 10:51:46 | Security | Success Audit | 515 | A trusted logon process has registered with the Local Security Authority. This logon process will be trusted to submit logon requests. Logon Process Name: DCOMSCM |
| 09/01/2004 | 10:51:46 | Security | Success Audit | 612 | Audit Policy Change: New Policy: Success Failure + + Logon/Logoff - - Object Access - - Privilege Use + + Account Management + + Policy Change + + System - - Detailed Tracking + + Directory Service Access + + Account Logon Changed By: User Name: EMACHINE$ Domain Name: acme Logon ID: (0x0,0x3E7) |
| 09/01/2004 | 10:51:46 | Security | Success Audit | 514 | An authentication package has been loaded by the Local Security Authority. This authentication package will be used to authenticate logon attempts. Authentication Package Name: C:\WINDOWS\system32\schannel.dll : Microsoft Unified Security Protocol Provider |
| 09/01/2004 | 10:51:46 | Security | Success Audit | 514 | An authentication package has been loaded by the Local Security Authority. This authentication package will be used to authenticate logon attempts. Authentication Package Name: C:\WINDOWS\system32\wdigest.dll : WDigest |
| 09/01/2004 | 10:51:46 | Security | Success Audit | 514 | An authentication package has been loaded by the Local Security Authority. This authentication package will be used to authenticate logon attempts. Authentication Package Name: C:\WINDOWS\system32\schannel.dll : Schannel |
| 09/01/2004 | 10:51:46 | Security | Success Audit | 515 | A trusted logon process has registered with the Local Security Authority. This logon process will be trusted to submit logon requests. Logon Process Name: Winlogon\MSGina |
| 08/31/2004 | 16:41:00 | Security | Success Audit | 513 | Windows is shutting down. All logon sessions will be terminated by this shutdown. |
| 08/31/2004 | 16:40:29 | Security | Success Audit | 551 | User initiated logoff: User Name: asmith Domain: acme Logon ID: (0x0,0xnnnn) |
| 08/31/2004 | 16:11:00 | Security | Success Audit | 515 | A trusted logon process has registered with the Local Security Authority. This logon process will be trusted to submit logon requests. Logon Process Name: KSecDD |