Knowledge base
Windows Event ID reference
The Windows and Windows Server event IDs we look up most, in plain English: what each one means, why it matters, and what to check next.
49 events
- 4Kerberos client received KRB_AP_ERR_MODIFIEDWarning
- 7The device has a bad blockCritical
- 20Installation failure: Windows failed to install an updateWarning
- 41The system rebooted without cleanly shutting down firstCritical
- 55A corruption was discovered in the file system structureCritical
- 153The IO operation was retriedWarning
- 1000An application crashedWarning
- 1001The computer has rebooted from a bugcheck (blue screen)Critical
- 1058Group Policy processing failed: could not read gpt.iniWarning
- 1074A process initiated a restart or shutdownInfo
- 1102The audit log was clearedCritical
- 1116Microsoft Defender Antivirus detected malwareCritical
- 1129Group Policy processing failed because of lack of network connectivity to a domain controllerWarning
- 1149Remote Desktop user authentication succeededInfo
- 2042Replication hasn’t occurred for longer than the tombstone lifetimeCritical
- 2213DFS Replication stopped after an unexpected shutdownWarning
- 4012DFS Replication stopped replicating a folder (offline too long)Critical
- 4104PowerShell script block loggedInfo
- 4624An account was successfully logged onInfo
- 4625An account failed to log onWarning
- 4634An account was logged offInfo
- 4648A logon was attempted using explicit credentialsInfo
- 4672Special privileges assigned to new logonInfo
- 4688A new process has been createdInfo
- 4697A service was installed in the systemWarning
- 4698A scheduled task was createdWarning
- 4719System audit policy was changedWarning
- 4720A user account was createdInfo
- 4722A user account was enabledInfo
- 4724An attempt was made to reset an account’s passwordInfo
- 4725A user account was disabledInfo
- 4726A user account was deletedInfo
- 4728A member was added to a security-enabled global groupWarning
- 4732A member was added to a security-enabled local groupWarning
- 4740A user account was locked outWarning
- 4756A member was added to a security-enabled universal groupWarning
- 4767A user account was unlockedInfo
- 4768A Kerberos authentication ticket (TGT) was requestedInfo
- 4769A Kerberos service ticket was requestedInfo
- 4771Kerberos pre-authentication failedWarning
- 4776The computer attempted to validate the credentials for an accountInfo
- 5719The computer could not set up a secure session with a domain controllerWarning
- 5805The session setup from a computer failed to authenticateWarning
- 6005The Event Log service was started (6005) or stopped (6006)Info
- 6008The previous system shutdown was unexpectedWarning
- 7000A service failed to startWarning
- 7031A service terminated unexpectedlyWarning
- 7045A service was installed in the systemWarning
- 36887A fatal TLS alert was received from the remote endpointInfo
No events match. Try another ID or keyword, or ask our assistant.
