J Microsoft Windows Operating System Audit Events

This appendix maps audit event names used in the Microsoft Windows Operating System to their equivalent values in the command_class and target_type fields in the Oracle AVDF audit record. You can use the audit events mapped here to create custom audit reports using other Oracle Database reporting products or third-party tools. See also "Oracle Audit Vault and Database Firewall Database Schemas" for Oracle AVDF data warehouse details that may be useful in designing your own reports.

Table J-1 lists the Windows audit events and the equivalent Oracle AVDF events.

Table J-1 Windows Operating System Audit Events

Source Event command_class target_type

ACCOUNT_MAPPED_FOR_LOGON

LOGIN

ACCOUNT

ACCOUNT_COULD_NOT_MAP_FOR_LOGON

LOGIN

ACCOUNT

ATTEMPTED_TO_VALIDATE_ACCOUNT_CREDENTIAL

VALIDATE

ACCOUNT

FAILED_TO_VALIDATE_ACCOUNT_CREDENTIAL

VALIDATE

ACCOUNT

KERBEROS_AUTHENTICATE_TICKET_REQUEST

AUTHENTICATE

SYSTEM

KERBEROS_PRE_AUTHENTICATION_FAILED

AUTHENTICATE

SYSTEM

KERBEROS_AUTHENTICATION_TICKET_REQUEST_FAILED

AUTHENTICATE

SYSTEM

KERBEROS_SERVICE_TICKET_REQUESTED

REQUEST

SYSTEM

KERBEROS_SERVICE_TICKET_RENEWED

RENEW

SYSTEM

BASIC_APPLICATION_GROUP_CREATED

CREATE

GROUP

BASIC_APPLICATION_GROUP_MODIFIED

UPDATE

GROUP

MEMBER_ADDED_TO_BASIC_APPLICATION_GROUP

UPDATE

GROUP

MEMBER_REMOVED_FROM_BASIC_APPLICATION_GROUP

UPDATE

GROUP

NON-MEMBER_ADDED_TO_BASIC_APPLICATION_GROUP

UPDATE

GROUP

NON-MEMBER_REMOVED_FROM_BASIC_APPLICATION_GROUP

UPDATE

GROUP

BASIC_APPLICATION_GROUP_DELETED

DELETE

GROUP

LDAP_QUERY_GROUP_CREATED

CREATE

GROUP

COMPUTER_ACCOUNT_CREATED

CREATE

ACCOUNT

COMPUTER_ACCOUNT_MODIFIED

UPDATE

ACCOUNT

COMPUTER_ACCOUNT_DELETED

DELETE

ACCOUNT

SECURITY-DISABLED_LOCAL_GROUP_CREATED

CREATE

GROUP

SECURITY-DISABLED_LOCAL_GROUP_MODIFIED

UPDATE

GROUP

MEMBER_ADDED_TO_SECURITY-DISABLED_LOCAL_GROUP

UPDATE

GROUP

MEMBER_REMOVED_FROM_SECURITY-DISABLED_LOCAL_GROUP

UPDATE

GROUP

SECURITY-DISABLED_LOCAL_GROUP_DELETED

DELETE

GROUP

SECURITY-DISABLED_GLOBAL_GROUP_CREATED

CREATE

GROUP

SECURITY-DISABLED_GLOBAL_GROUP_MODIFIED

UPDATE

GROUP

MEMBER_ADDED_TO_SECURITY-DISABLED_GLOBAL_GROUP

UPDATE

GROUP

MEMBER_REMOVED_FROM_SECURITY-DISABLED_GLOBAL_GROUP

UPDATE

GROUP

SECURITY-DISABLED_GLOBAL_GROUP_DELETED

DELETE

GROUP

SECURITY-DISABLED_UNIVERSAL_GROUP_CREATED

CREATE

GROUP

SECURITY-DISABLED_UNIVERSAL_GROUP_MODIFIED

UPDATE

GROUP

MEMBER_ADDED_TO_SECURITY-DISABLED_UNIVERSAL_GROUP

UPDATE

GROUP

MEMBER_REMOVED_FROM_SECURITY-DISABLED_UNIVERSAL_GROUP

UPDATE

GROUP

SECURITY-DISABLED_UNIVERSAL_GROUP_DELETED

DELETE

GROUP

PASSWORD_POLICY_CHECKING_API_CALLED

CALL

POLICY

SECURITY-ENABLED_GLOBAL_GROUP_CREATED

CREATE

GROUP

MEMBER_ADDED_TO_SECURITY-ENABLED_GLOBAL_GROUP

UPDATE

GROUP

MEMBER_REMOVED_FROM_SECURITY-ENABLED_GLOBAL_GROUP

UPDATE

GROUP

SECURITY-ENABLED_GLOBAL_GROUP_DELETED

DELETE

GROUP

SECURITY-ENABLED_LOCAL_GROUP_CREATED

CREATE

GROUP

MEMBER_ADDED_TO_SECURITY-ENABLED_LOCAL_GROUP

UPDATE

GROUP

MEMBER_REMOVED_FROM_SECURITY-ENABLED_LOCAL_GROUP

UPDATE

GROUP

SECURITY-ENABLED_LOCAL_GROUP_DELETED

DELETE

GROUP

SECURITY-ENABLED_LOCAL_GROUP_MODIFIED

UPDATE

GROUP

SECURITY-ENABLED_GLOBAL_GROUP_MODIFIED

UPDATE

GROUP

SECURITY-ENABLED_UNIVERSAL_GROUP_CREATED

CREATE

GROUP

SECURITY-ENABLED_UNIVERSAL_GROUP_MODIFIED

UPDATE

GROUP

MEMBER_ADDED_TO_SECURITY-ENABLED_UNIVERSAL_GROUP

UPDATE

GROUP

MEMBER_REMOVED_FROM_SECURITY-ENABLED_UNIVERSAL_GROUP

UPDATE

GROUP

SECURITY-ENABLED_UNIVERSAL_GROUP_DELETED

DELETE

GROUP

CHANGED_TYPE_OR_SCOPE_OF_GROUP

UPDATE

GROUP

CREATED_USER_ACCOUNT

CREATE

ACCOUNT

ENABLED_USER_ACCOUNT

ENABLE

ACCOUNT

ATTEMPTED_TO_MODIFY_ACCOUNT_PASSWORD

UPDATE

ACCOUNT

ATTEMPTED_TO_RESET_ACCOUNT_PASSWORD

RESET

ACCOUNT

DISABLED_USER_ACCOUNT

DISABLE

ACCOUNT

DELETED_USER_ACCOUNT

DELETE

ACCOUNT

MODIFIED_USER_ACCOUNT

UPDATE

ACCOUNT

LOCKED_OUT_USER_ACCOUNT

LOCK

ACCOUNT

SID_HISTORY_ADDED_TO_ACCOUNT

UPDATE

ACCOUNT

ATTEMPT_TO_ADD_SID_HISTORY_TO_ACCOUNT_FAILED

INSERT

ACCOUNT

UNLOCKED_USER_ACCOUNT

UNLOCK

ACCOUNT

ACL_SET_ON_ACCOUNT

SET

ACCOUNT

MODIFIED_ACCOUNT_NAME

UPDATE

ACCOUNT

MODIFIED_DIRECTORY_SERVICE_RESTORE_MODE_ADMIN_PASSWORD

UPDATE

SERVICE

BACKED_UP_CREDENTIAL_MANAGER_CREDENTIALS

BACKUP

MANAGER

RESTORED_CREDENTIAL_MANAGER_CREDENTIALS

RESTORE

MANAGER

CREATED_NEW_PROCESS

START

PROCESS

ASSIGNED_PRIMARY_TOKEN_TO_PROCESS

ASSIGN

PROCESS

EXITED_PROCESS

STOP

PROCESS

REMOTE_PROCEDURE_CALL_ATTEMPTED

REMOTE CALL

PROCEDURE

ACCOUNT_FAILED_TO_LOGON

LOGIN

ACCOUNT

LOGGED_OFF_ACCOUNT

LOGOUT

ACCOUNT

USER_INITIATED_LOGOFF

LOGOUT

ACCOUNT

ACCOUNT_LOGON_SUCCESSFUL

LOGIN

ACCOUNT

LOGON_ATTEMPTED_USING_EXPLICIT_CREDENTIAL

LOGIN

SYSTEM

NETWORK_POLICY_SERVER_GRANTED_USER_ACCESS

GRANT

USER

NETWORK_POLICY_SERVER_DENIED_USER_ACCESS

DENY

USER

NETWORK_POLICY_SERVER_DISCARDED_USER_REQUEST

DENY

USER

NETWORK_POLICY_SERVER_DISCARDED_USER_ACCOUNTING_REQUEST

DENY

USER

NETWORK_POLICY_SERVER_QUARANTINED_USER

QUARANTINE

USER

NETWORK_POLICY_SERVER_GRANTED_USER_ACCESS_WITH_PROBATION

GRANT

USER

NETWORK_POLICY_SERVER_GRANTED_FULL_ACCESS

GRANT

USER

NETWORK_POLICY_SERVER_LOCKED_USER_ACCOUNT

LOCK

ACCOUNT

NETWORK_POLICY_SERVER_UNLOCKED_USER_ACCOUNT

UNLOCK

ACCOUNT

REPLAY_ATTACK_DETECTED

GET

SYSTEM

SESSION_RECONNECTED_TO_WORKSTATION

CONNECT

WORKSTATION

SESSION_DISCONNECTED_FROM_WORKSTATION

DISCONNECT

WORKSTATION

LOCKED_WORKSTATION

LOCK

WORKSTATION

UNLOCKED_WORKSTATION

UNLOCK

WORKSTATION

INVOKED_SCREEN_SAVER

CALL

SCREEN SAVER

DISMISSED_SCREEN_SAVER

ABORT

SCREEN SAVER

REQUESTED_CREDENTIAL_DELEGATION_DISALLOWED_BY_POLICY

DENY

ACCOUNT

REQUEST_MADE_TO_AUTHENTICATE_WIRELESS_NETWORK

AUTHENTICATE

NETWORK

REQUEST_MADE_TO_AUTHENTICATE_WIRED_NETWORK

AUTHENTICATE

NETWORK

SPECIAL_GROUP_ASSIGNED_TO_LOGON

ASSIGN

ACCOUNT

CERTIFICATE_SERVICES_RECEIVED_RESUBMITTED_CERTIFICATE_REQUEST

RECEIVE

CERTIFICATE

CERTIFICATE_SERVICES_REVOKED_CERTIFICATE

REVOKE

CERTIFICATE

CERTIFICATE_SERVICES_RECEIVED_CERTIFICATE_REVOKATION_LIST_PUBLISH_REQUEST

RECEIVE

CRL

CERTIFICATE_SERVICES_PUBLISHED_CRL

PUBLISH

CRL

CERTIFICATE_REQUEST_EXTENSION_MODIFIED

UPDATE

CERTIFICATE

CERTIFICATE_REQUEST_ATTRIBUTES_MODIFIED

UPDATE

CERTIFICATE

CERTIFICATE_SERVICE_RECEIVED_SHUT_DOWN_REQUEST

RECEIVE

SERVICE

CERTIFICATE_SERVICE_BACKUP_STARTED

BACKUP

SERVICE

CERTIFICATE_SERVICE_BACKUP_COMPLETED

BACKUP

SERVICE

CERTIFICATE_SERVICE_RESTORE_STARTED

RESTORE

SERVICE

CERTIFICATE_SERVICE_RESTORE_COMPLETED

RESTORE

SERVICE

CERTIFICATE_SERVICE_STARTED

START

SERVICE

CERTIFICATE_SERVICE_STOPPED

STOP

SERVICE

CERTIFICATE_SERVICE_SECURITY_PERMISSIONS_MODIFIED

UPDATE

SERVICE

CERTIFICATE_SERVICE_RETRIEVED_ARCHIVED_KEY

RETRIEVE

SERVICE

CERTIFICATE_SERVICE_IMPORTED_CERTIFICATE_IN_ITS_DATABASE

IMPORT

SERVICE

AUDIT_FILTER_FOR_CERTIFICATE_SERVICE_CHANGED

UPDATE

SERVICE

CERTIFICATE_SERVICE_RECEIVED_CERTIFICATE_REQUEST

RECEIVE

SERVICE

CERTIFICATE_SERVICE_APPROVED_CERTIFICATE_REQUEST_AND_ISSUED_CERTIFICATE

GRANT

SERVICE

CERTIFICATE_SERVICE_DENIED_CERTIFICATE_REQUEST

DENY

SERVICE

CERTIFICATE_SERVICE_SET_CERTIFICATE_REQUEST_STATUS_TO_PENDING

SET

SERVICE

CERTIFICATE_MANAGER_SETTINGS_FOR_CERTIFICATE_SERVICE_MODIFIED

UPDATE

SERVICE

CERTIFICATE_SERVICE_CONFIGURATION_ENTRY_MODIFIED

UPDATE

SERVICE

CERTIFICATE_SERVICE_PROPERTY_MODIFIED

UPDATE

SERVICE

CERTIFICATE_SERVICE_ARCHIVED_KEY

ARCHIVE

SERVICE

CERTIFICATE_SERVICE_IMPORTED_AND_ARCHIVED_KEY

ARCHIVE

SERVICE

CERTIFICATE_SERVICE_PUBLISHED_CA_CERTIFICATE_TO_ACTIVE_DIRECTORY_DOMAIN_SERVICES

PUBLISH

SERVICE

ROWS_DELETED_FROM_CERTIFICATE_DATABASE

DELETE

DATABASE

ENABLED_ROLE_SEPERATION_ON_CERTIFICATION_AUTHORITY

ENABLE

ROLE

CERTIFICATE_SERVICE_LOADED_TEMPLATE

LOAD

TEMPLATE

NETWORK_SHARE_OBJECT_ACCESSED

ACCESS

OBJECT

ATTEMPT_MADE_TO_CREATE_HARD_LINK

CREATE

FILE

TRANSACTION_STATE_CHANGED

UPDATE

SYSTEM

FILE_WAS_VIRTUALIZED

ASSIGN

FILE

SE_AUDITID_ETW_FIREWALL_APP_BLOCKED_FROM_LISTENING

BLOCK

APPLICATION

WINDOWS_FILTERING_PLATFORM_PERMITTED_APPLICATION_TO_LISTEN_ON_PORT

GRANT

APPLICATION

WINDOWS_FILTERING_PLATFORM_BLOCKED_APPLICATION_FROM_LISTENING_ON_PORT

BLOCK

APPLICATION

WINDOWS_FILTERING_PLATFORM_BLOCKED_CONNECTION

BLOCK

CONNECTION

WINDOWS_FILTERING_PLATFORM_PERMITTED_BIND_TO_LOCAL_PORT

GRANT

PORT

WINDOWS_FILTERING_PLATFORM_BLOCKED_BIND_TO_LOCAL_PORT

BLOCK

PORT

WINDOWS_FILTERING_PLATFORM_BLOCKED_PACKET

BLOCK

PACKET

RESTRICTIVE_WINDOWS_FILTERING_PLATFORM_BLOCKED_PACKET

BLOCK

PACKET

HANDLE_TO_OBJECT_REQUESTED

REQUEST

OBJECT

HANDLE_TO_OBJECT_CLOSED

CLOSE

OBJECT

ATTEMPT_MADE_TO_DUPLICATE_HANDLE_TO_OBJECT

ACCESS

OBJECT

APPLICATION_ATTEMPTED_TO_ACCESS_BLOCKED_ORDINAL

ACCESS

ORDINAL

INDIRECT_ACCESS_TO_OBJECT_REQUESTED

ACCESS

OBJECT

CREATED_SCHEDULED_TASK

CREATE

TASK

DELETED_SCHEDULED_TASK

DELETE

TASK

ENABLED_SCHEDULED_TASK

ENABLE

TASK

DISABLED_SCHEDULED_TASK

DISABLE

TASK

UPDATED_SCHEDULED_TASK

UPDATE

TASK

OBJECT_IN_COM+_CATALOG_MODIFIED

UPDATE

OBJECT

OBJECT_DELETED_FROM_COM+_CATALOG

DELETE

OBJECT

OBJECT_ADDED_TO_COM+_CATALOG

INSERT

OBJECT

MODIFIED_REGISTRY_VALUE

UPDATE

REGISTRY

VIRTUALIZED_REGISTRY_KEY

ASSIGN

REGISTRY

HANDLE_TO_OBJECT_REQUESTED_WITH_DELETE_INTENT

REQUEST

OBJECT

OBJECT_DELETED

DELETE

OBJECT

HANDLE_TO_OBJECT_REQUESTED

REQUEST

OBJECT

OBJECT_ACCESS_ATTEMPTED

ACCESS

OBJECT

AUDIT_POLICY_ON_OBJECT_CHANGED

AUDIT

POLICY

SYSTEM_AUDIT_POLICY_CHANGED

AUDIT

POLICY

ATTEMPT_MADE_TO_REGISTER_SECURITY_EVENT_SOURCE

REGISTER

LOG

ATTEMPT_MADE_TO_UNREGISTER_SECURITY_EVENT_SOURCE

UNREGISTER

LOG

CRASHONAUDITFAIL_VALUE_MODIFIED

UPDATE

CRASHONAUDITFAIL

MODIFIED_AUDITING_SETTINGS_ON_OBJECT

AUDIT

OBJECT

MODIFIED_SPECIAL_GROUPS_LOGON_TABLE

UPDATE

GROUP

MODIFIED_PER_USER_AUDIT_POLICY

AUDIT

POLICY

KERBEROS_POLICY_MODIFIED

UPDATE

POLICY

TRUSTED_DOMAIN_INFORMATION_MODIFIED

UPDATE

DOMAIN

GRANTED_SYSTEM_SECURITY_ACCESS_TO_ACCOUNT

GRANT

ACCOUNT

REMOVED_SYSTEM_SECURITY_ACCESS_FROM_ACCOUNT

DROP

ACCOUNT

MODIFIED_DOMAIN_POLICY

UPDATE

DOMAIN

NAMESPACE_COLLISION_DETECTED

GET

NAMESPACE

TRUSTED_FOREST_INFORMATION_ENTRY_ADDED

INSERT

INFORMATION

TRUSTED_FOREST_INFORMATION_ENTRY_REMOVED

DROP

INFORMATION

TRUSTED_FOREST_INFORMATION_ENTRY_MODIFIED

UPDATE

INFORMATION

USER_RIGHT_ASSIGNED

ASSIGN

USER

USER_RIGHT_REMOVED

DROP

USER

NEW_TRUST_CREATED_TO_DOMAIN

CREATE

DOMAIN

TRUST_TO_DOMAIN_REMOVED

DROP

DOMAIN

ENCRYPTED_DATA_RECOVERY_POLICY_MODIFIED

UPDATE

POLICY

SE_AUDITID_ETW_IPSEC_POLICY_START

START

SERVICE

SE_AUDITID_ETW_IPSEC_POLICY_DISABLED

DISABLE

SERVICE

APPLIED_PASTORE_ENGINE

APPLY

ENGINE

SE_AUDITID_ETW_IPSEC_POLICY_FAILURE

FAIL

SERVICE

SE_AUDITID_ETW_IPSEC_AUTHENTICATION_SET_ADD

INSERT

SETTING

SE_AUDITID_ETW_IPSEC_AUTHENTICATION_SET_CHANGE

UPDATE

SETTING

SE_AUDITID_ETW_IPSEC_AUTHENTICATION_SET_DELETE

DELETE

SETTING

SE_AUDITID_ETW_IPSEC_CONNECTION_SECURITY_ADD

INSERT

SETTING

SE_AUDITID_ETW_IPSEC_CONNECTION_SECURITY_CHANGE

UPDATE

SETTING

SE_AUDITID_ETW_IPSEC_CONNECTION_SECURITY_DELETE

DELETE

SETTING

SE_AUDITID_ETW_IPSEC_CRYPTO_SET_ADD

ADD

SETTINGS

SE_AUDITID_ETW_IPSEC_CRYPTO_SET_CHANGE

MODIFY

SETTINGS

SE_AUDITID_ETW_IPSEC_CRYPTO_SET_DELETE

DELETE

SETTINGS

WINDOWS_FILTERING_PLATFORM_CALLOUTS_MODIFIED

UPDATE

CALLOUT

WINDOWS_FILTERING_PLATFORM_PROVIDER_MODIFIED

UPDATE

PROVIDER

WINDOWS_FILTERING_PLATFORM_PROVIDER_CONTEXT_MODIFIED

UPDATE

CONTEXT

WINDOWS_FILTERING_PLATFORM_SUBLAYER_MODIFIED

UPDATE

SUBLAYER

SE_AUDITID_ETW_FIREWALL_STARTUP_STATE

START

FIREWALL

SE_AUDITID_ETW_FIREWALL_STARTUP_STATE_RULE

READ

RULE

SE_AUDITID_ETW_FIREWALL_RULE_ADD

INSERT

RULE

SE_AUDITID_ETW_FIREWALL_RULE_CHANGE

UPDATE

RULE

SE_AUDITID_ETW_FIREWALL_RULE_DELETE

DELETE

RULE

SE_AUDITID_ETW_FIREWALL_RESTORE_DEFAULTS

RESTORE

FIREWALL

SE_AUDITID_ETW_FIREWALL_SETTING_CHANGE

UPDATE

FIREWALL

SE_AUDITID_ETW_FIREWALL_GROUP_POLICY_CHANGED

UPDATE

FIREWALL

SE_AUDITID_ETW_FIREWALL_PROFILE_CHANGE

UPDATE

PROFILE

WINDOWS_FILTERING_PLATFORM_CHANGED_FILTER

UPDATE

FILTER

ERROR_OCCURED_WHILE_PROCESSING_SECURITY_POLICY_IN_GROUP_POLICY_OBJECTS

GET

POLICY

OBJECT_PERMISSION_MODIFIED

UPDATE

OBJECT

SPECIAL_PRIVILEGES_ASSIGNED_TO_NEW_LOGON

ASSIGN

ACCOUNT

PRIVILEGED_SERVICE_CALLED

CALL

SERVICE

OPERATION_ATTEMPTED_ON_PRIVILEGED_OBJECT

EXECUTE

OBJECT

IPSEC_DROPPED_INBOUND_PACKET_THAT_FAILED_INTEGRITY_CHECK

DROP

PACKET

IPSEC_DROPPED_INBOUND_PACKET_THAT_FAILED_REPLAY_BACK

DROP

PACKET

IPSEC_DROPPED_INBOUND_PACKET_THAT_FAILED_REPLAY_BACK

DROP

PACKET

IPSEC_DROPPED_INSECURE_CLEAR_TEXT_PACKET

DROP

PACKET

IPSEC_RECEIVED_PACKET_FROM_REMOTE_COMPUTER_WITH_INCORRECT_SPI

RECEIVE

PACKET

SE_AUDITID_ETW_POLICYAGENT_IPSECSVC_SUCCESSFUL_START

START

SERVICE

SE_AUDITID_ETW_POLICYAGENT_IPSECSVC_SUCCESSFUL_SHUTDOWN

STOP

SERVICE

SE_AUDITID_ETW_POLICYAGENT_IPSECSVC_INTERFACE_LIST_INCOMPLETE

FAIL

SERVICE

SE_AUDITID_ETW_POLICYAGENT_IPSECSVC_RPC_INIT_FAILURE

FAIL

SERVICE

SE_AUDITID_ETW_POLICYAGENT_IPSECSVC_ERROR_SHUTDOWN

STOPE

SERVICE

SE_AUDITID_ETW_POLICYAGENT_IPSECSVC_FAILED_PNP_FILTER_PROCESSING

FAIL

SERVICE

SE_AUDITID_ETW_MPSFIREWALL_SERVICE_STARTUP

START

FIREWALL

SE_AUDITID_ETW_MPSFIREWALL_STOPPED

STOP

FIREWALL

SE_AUDITID_ETW_MPSFIREWALL_GET_POLICY_FAILURE

RETRIEVE

FIREWALL

SE_AUDITID_ETW_MPSFIREWALL_PARSE_POLICY_FAILURE

FAIL

FIREWALL

SE_AUDITID_ETW_MPSFIREWALL_INIT_DRIVER_FAILURE

FAIL

FIREWALL

SE_AUDITID_ETW_MPSFIREWALL_SERVICE_STARTUP_FAILURE

FAIL

FIREWALL

SE_AUDITID_ETW_FIREWALL_UPCALL_NOTIFICATION_ERROR

NOTIFY

FIREWALL

SE_AUDITID_ETW_MPSFIREWALL_DRIVER_STARTED

START

DRIVER

SE_AUDITID_ETW_MPSFIREWALL_DRIVER_STOPPED

STOP

DRIVER

SE_AUDITID_ETW_MPSFIREWALL_DRIVER_STARTUP_FAILURE

FAIL

DRIVER

SE_AUDITID_ETW_MPSFIREWALL_DRIVER_CRITICAL_ERROR

ABORT

DRIVER

KEY_FILE_OPERATION

READ

KEY

KEY_MIGRATION_OPERATION

MIGRATE

KEY

WINDOWS_STARTING_UP

STARTUP

OS

WINDOWS_SHUTTING_DOWN

SHUTDOWN

OS

SYSTEM_TIME_CHANGED

UPDATE

SYSTEM TIME

ADMINISTRATOR_RECOVERED_SYSTEM_FROM_CRASHONAUDITFAIL

RECOVER

SYSTEM

LOCAL_SECURITY_AUTHORITY_LOADED_AUTHENTICATION_PACKAGE

LOAD

AUTHORITY

TRUSTED_LOGON_PROCESS_REGISTERED_WITH_LOCAL_SECURITY_AUTHORITY

REGISTER

PROCESS

SECURITY_ACCOUNT_MANAGER_LOADED_NOTIFICATION_PACKAGE

LOAD

MANAGER

LOCAL_SECURITY_AUTHORITY_LOADED_SECURITY_PACKAGE

LOAD

AUTHORITY

SERVICE_INSTALLED_IN_SYSTEM

INSTALL

SERVICE

EXHAUSTED_INTERNAL_RESOURCES_ALLOCATED_FOR_QUEUING_OF_AUDIT_MESSAGES

EXCEED

MESSAGES

INVALID_USE_LOCAL_PROCEDURE_CALL_PORT_BY_AN_APPLICATION

INVALID

PORT

MONITORED_SECURITY_EVENT_PATTERN_OCCURRED

RECEIVE

PATTERN

RPC_DETECTED_INTEGRITY_VIOLATION_WHILE_DECRYPTING_INCOMING_MESSAGE

GET

MESSAGE

DETERMINED_INVALID_IMAGE_HASH_OF_FILE

CALCULATE

FILE

CRYPTROGRAPHIC_PRIMITIVE_OPERATION_FAILED

FAIL

OPERATION

VERIFICATION_OPERATION_FAILED

FAIL

OPERATION

CRYPTROGRAPHIC_OPERATION

EXECUTE

OPERATION

LDAP_QUERY_GROUP_MODIFIED

UPDATE

GROUP

LDAP_QUERY_GROUP_DELETED

DELETE

GROUP

CERTIFICATE_SERVICE_TEMPLATE_MODIFIED

UPDATE

TEMPLATE

CERTIFICATE_SERVICE_TEMPLATE_SECURITY_MODIFIED

UPDATE

TEMPLATE

OCSP_RESPONDER_SERVICE_STARTED

START

SERVICE

OCSP_RESPONDER_SERVICE_STOPPED

STOP

SERVICE

CONFIGURATION_ENTRY_CHANGED_IN_OCSP_RESPONDER_SERVICE

UPDATE

SERVICE

CONFIGURATION_ENTRY_CHANGED_IN_OCSP_RESPONDER_SERVICE

UPDATE

SERVICE

SECURITY_SETTING_MODIFIED_ON_OCSP_RESPONDER_SERVICE

UPDATE

SERVICE

REQUEST_SUBMITTED_TO_OCSP_RESPONDER_SERVICE

SUBMIT

SERVICE

OCSP_RESPODER_SERVICE_AUTOMATICALLY_MODIFIED_SIGNING_CERTIFICATE

UPDATE

CERTIFICATE

OCSP_REVOCATION_PROVIDER_UPDATED_REVOCATION_INFORMATION

UPDATE

INFORMATION

AUDIT_LOG_CLEARED

DELETE

AUDIT LOG

EVENT_LOGGING_SERVICE_HAS_SHUTDOWN

STOP

SERVICE

SECURITY_LOG_IS_FULL

EXCEED

AUDIT LOG

NETWORK_SHARE_OBJECT_ADDED

INSERT

OBJECT

NETWORK_SHARE_OBJECT_MODIFIED

UPDATE

OBJECT

NETWORK_SHARE_OBJECT_DELETED

DELETE

OBJECT

MODIFIED_AUDITING_SETTINGS_ON_OBJECT

AUDIT

OBJECT

NETWORK_SHARE_OBJECT_CHECKED_TO_SEE_CLIENT_GRANTED_DESIRED_ACCESS

VALIDATE

OBJECT