Windows Audit Event Reference
Event ID | Symbolic ID | Description |
|---|---|---|
1 | AUTH_CHAIN_FAILURE | User failed to authenticate |
2 | AUTH_CHAIN_SUCCESS | User successfully authenticated |
3 | USER_LOGIN_LOCKOUT | User lockout is triggered |
4 | DB_COMMIT_SUSPEND | Database commits suspended, replication queue full |
5 | DB_COMMIT_RESUME | Database commits resuming |
6 | DB_REPLICATION_CONN_FAILURE | Connectivity to replica database lost |
7 | DB_REPLICATION_CONN_RESTORED | Connectivity to replica database restored |
8 | DB_REPLICATION_TRANS_FAILURE | Failed to replicate database transaction |
9 | DB_QUEUE_INSERT_FAILURE | Failed to insert data into database replication queue |
10 | DB_FAILED_PROC_RECORDED | Failed to run stored procedure on replica server |
11 | PAMSA_ORCHESTRATION_START_FAILURE | Subscriber orchestration failed to start |
12 | PAMSA_ORCHESTRATION_END_FAILURE | Subscriber orchestration completed with failures |
13 | UPDATE_RESOURCE_FAILURE | Failed to update subscriber password |
14 | GSET_CHECKIN_FAILURE | Failed to check-in managed group set |
15 | GSET_CHECKIN_PARTIAL | Failed to fully check-in managed group set, some memberships were not revoked |
16 | GSET_CHECKIN_SUCCESS | Managed group set successfully checked in |
17 | GSET_CHECKOUT_SUCCESS | Managed group set successfully checked out |
18 | GSET_CHECKOUT_FAILURE | Failed to check out managed group set |
19 | GSET_CHECKOUT_PARTIAL | Managed group set partially checked out, some memberships were not granted |
20 | PWD_CHECKOUT_SUCCESS | Managed account password successfully checked out |
21 | PWD_CHECKOUT_FAILURE | Failed to check-out managed account password |
22 | PWD_CHECKIN_SUCCESS | Managed account password successfully checked in |
23 | PWD_CHECKIN_FAILURE | Failed to check-in managed account password |
24 | WSTN_VIEW_PASSWORD_SUCCESS | Managed account password viewed |
25 | WSTN_VIEW_PASSWORD_FAILURE | Failed to view managed account password |
26 | WSTN_VIEW_PASSWORD_HIS_SUCCESS | Historical managed account password viewed |
27 | WSTN_VIEW_PASSWORD_HIS_FAILURE | Failed to view historical managed account password |
28 | ADMIN_ENABLE_ADMIN | Administrative profile enabled |
29 | ADMIN_ENABLE_USER | User profile enabled |
30 | ADMIN_DISABLE_ADMIN | Administrative profile disabled |
31 | ADMIN_DISABLE_USER | User profile disabled |
32 | ADMIN_UNLOCK_ADMIN | Administrative profile unlocked |
33 | ADMIN_UNLOCK_USER | User profile unlocked |
34 | SMON_SESSION_START | Privileged access session recording started |
35 | SMON_SESSION_END | Privileged access session recording ended |
36 | SMON_ADMIN_SESS_TERM_REQ | Privileged access session termination requested by administrator |
37 | PSUPDATE_START | Nightly discovery process started |
38 | PSUPDATE_FINISH | Nightly discovery process finished |
39 | IDAPI_LOGIN_SUCCESS | API login succeeded |
40 | IDAPI_LOGIN_FAILURE | API login failure |
41 | MAQ_CHECKIN_FAILURE | Failed to check in system and account query based access |
42 | MAQ_CHECKIN_SUCCESS | Succeeded in checking in system and account query based access |
43 | MAQ_CHECKOUT_FAILURE | Failed to check out system and account query based access |
44 | MAQ_CHECKOUT_SUCCESS | Succeeded in checking out system and account query based access |
45 | TARGET_DEPLOYMENT_FAILURE | Target deployment finished with a failure. |
46 | TARGET_DEPLOYMENT_SUCCESS | Successfully finished target deployment. |
47 | OPERATION_IMPORT_TARGET | Successfully imported a single target. |
48 | WSTN_ADD_WSTN_SUCCESS | Successfully finished target deployment. |
49 | WSTN_ADD_WSTN_FAILURE | Target deployment finished with a failure. |
50 | IDWFM_EVENT_ABORT | Workflow manager aborted event processing. |
51 | IDWFM_EVENT_FAILURE | Workflow manager failed to process event. |
52 | USER_QA_ADD_SUCCESS | Security question successfully added. |
53 | USER_QA_ADD_FAILURE | Failed to add security question. |
54 | USER_QA_UPDATE_SUCCESS | Security question successfully updated. |
55 | USER_QA_UPDATE_FAILURE | Failed to update security question. |
56 | USER_QA_DELETE_SUCCESS | Security question successfully deleted. |
57 | ADMIN_QA_ADD_SUCCESS | Security question successfully added. |
58 | ADMIN_QA_ADD_FAILURE | Failed to add security question. |
59 | ADMIN_QA_UPDATE_SUCCESS | Security question successfully updated. |
60 | ADMIN_QA_UPDATE_FAILURE | Failed to update security question. |
61 | ADMIN_QA_DELETE_SUCCESS | Security question successfully deleted. |
62 | USER_PW_RESET_START | Self-service password reset started. |
63 | USER_PW_RESET_SUCCESS | Self-service password reset successful. |
64 | USER_PW_RESET_FAILURE | Self-service password reset failed. |
65 | ADMIN_PW_RESET_START | Help-desk assisted password reset started. |
66 | ADMIN_PW_RESET_SUCCESS | Help-desk assisted password reset successful. |
67 | ADMIN_PW_RESET_FAILURE | Help-desk assisted password reset failed. |
68 | USER_ACCT_UNLOCK_START | Self-service account unlock started. |
69 | USER_ACCT_UNLOCK_SUCCESS | Self-service account unlock successful. |
70 | USER_ACCT_UNLOCK_FAILURE | Self-service account unlock failed. |
71 | ADMIN_ACCT_UNLOCK_START | Help-desk assisted account unlock started. |
72 | ADMIN_ACCT_UNLOCK_SUCCESS | Help-desk assisted account unlock successful. |
73 | ADMIN_ACCT_UNLOCK_FAILURE | Help-desk assisted password reset failed. |
74 | DB_REPLICATION_WATERMARK_WARN | Database replication watermark hit. |
75 | USER_ALIAS_ALREADY_CLAIMED | User attempted to claim alias that is already claimed. |
76 | ADMIN_ALIAS_ALREADY_CLAIMED | Admin attempted to assign alias that is already claimed. |
77 | CONNECTOR_TIMEOUT | Connector timed out while performing operation. |
78 | FILE_REPLICATION_FAILURE | Error occured during file replication to remote nodes. |
79 | IDPM_GROUP_SUCCESS | All passwords successfully synchronized. |
80 | IDPM_GROUP_FAILURE | One or more passwords failed to be synchronized. |
81 | WF_REQUEST_BATCH_APPROVED | Workflow request has been approved. |
82 | WF_REQUEST_BATCH_REJECTED | Workflow request has been rejected. |
83 | WF_REQUEST_BATCH_CANCELED | Workflow request has been canceled. |
84 | WF_REQUEST_BATCH_REVOKED | Workflow request has been revoked. |
85 | WF_REQUEST_BATCH_PROCESSED | Workflow request has been processed. |
86 | DID_REGISTER_SUCCESS | Successfully registered Digital ID. |
87 | DID_REGISTER_FAILURE | Failed to register Digital ID. |
88 | DID_UPDATE_SUCCESS | Successfully updated Digital ID. |
89 | DID_SEND_SUCCESS | Digital ID successfully downloaded. |
90 | USER_IDENTIFY_SUCCESS | User successfully identified |
91 | USER_IDENTIFY_FAILURE | Failed to identify user. |
92 | USER_LOGIN_SUCCESS | User successfully logged in. |
93 | USER_LOGIN_FAILURE | User failed to log in. |
94 | FEDIDP_IDENTIFY_SUCCESS | Federated authn request successfully parsed. |
95 | FEDIDP_IDENTIFY_FAILURE | Federated authn request failed to be parsed. |
96 | FEDIDP_AUTH_SUCCESS | Federated assertion successfully generated. |
97 | FEDIDP_AUTH_FAILURE | Federated assertion failed to be generated. |
98 | DB_STORED_PROC_FAILURE | Failed to execute stored procedure. |
99 | ADMIN_CRED_FAILURE | Target creation failure: Could not establish credentials. |
100 | ADMIN_CRED_SUCCESS | Target creation successful: Credentials set successfully. |
101 | FEDIDP_SSO_SESSION_CREATE | New federated SSO session created. |
102 | FEDIDP_SSO_SESSION_DESTROY | Federated SSO session terminated. |
103 | PAM_CHECKOUT_SUCCESS | Generic access check-out successful. |
104 | PAM_CHECKOUT_PARTIAL | Generic access check-out partially successful. |
105 | PAM_CHECKOUT_FAILURE | Generic access check-out failed. |
106 | PAM_CHECKIN_SUCCESS | Generic access check-in successful. |
107 | PAM_CHECKIN_PARTIAL | Generic access check-in partially successful. |
108 | PAM_CHECKIN_FAILURE | Generic access check-in failed. |
109 | PAM_CHECKOUT_EXPIRY | Generic access check-out expired. |
110 | PAM_CHECKOUT_LIMIT_REACHED | Generic access check-out cannot be performed because it would exceed the check-out limit of one of its targets. |
111 | PAM_CHECKOUT_OPERATION_SUCCESS | An operation run as part of a generic access check-out succeeded. |
112 | PAM_CHECKOUT_OPERATION_FAILURE | An operation run as part of a generic access check-out failed. |
113 | PAM_CHECKIN_OPERATION_SUCCESS | An operation run as part of a generic access check-in succeeded. |
114 | PAM_CHECKIN_OPERATION_FAILURE | An operation run as part of a generic access check-in failed. |
115 | FEDSP_SAMLAUTH_ASR_FAILURE | Failed to validate a SAML assertion. |
116 | FEDSP_SAMLAUTH_ASR_SUCCESS | Successfully validated a SAML assertion. |
117 | FEDSP_SAMLAUTH_ISSUED | Issued SAML AuthNRequest. |
118 | DB_REPLICATION_QUEUE_DELAY_PAST_THRESHOLD | Database replication queue delay exceeded configured threshold. |
119 | CRITICAL_FAILURE | A critical failure was detected. |
120 | USER_HDD_RECOVERY_FAILURE | Self-service encrypted drive recovery failure. |
121 | USER_MOBILE_DEVICE_REGISTRATION | Self-service mobile device registration. |