Windows Security event IDs for investigators
The Windows Security log records authentication, account changes and policy changes as numbered events. Microsoft documents each one for administrators; these pages read them as an investigator does — which machine logs the event, which fields carry the signal, what an attack looks like next to everyday noise, and the KQL that finds it in Microsoft Sentinel. Every page quotes Microsoft’s title for the event, and every field it names is checked against Microsoft’s documentation on each build.
Two facts decide where to look. Logon events such as 4624 and 4625 are written on the computer that processed the logon, so a password spray against many servers is spread across many Security logs. Kerberos (4768, 4771) and NTLM validation (4776) events are written on domain controllers, which is where an attack that never touches a member server still shows up.
| Event | Microsoft’s title | What it means for you |
|---|---|---|
| 4624 | An account was successfully logged on. | A logon session was created on this computer — the logon type, source address and logon ID tell you how the session was established and let you follow everything it did next. |
| 4625 | An account failed to log on. | Windows rejected a logon attempt — the Status and Sub Status fields say why it failed, and the logon type, workstation name and source address say where the attempt came from. |
| 4648 | A logon was attempted using explicit credentials. | A process supplied another account's credentials on purpose — routine for scheduled tasks and RunAs, but it is also the trace an attacker leaves when switching identity before reaching another machine. |
| 4740 | A user account was locked out. | An account was locked out — the event names the account and the computer the attempts came from, but not the IP, the logon type or the reason, so the preceding failure events carry the real story. |
| 4768 | A Kerberos authentication ticket (TGT) was requested. | A domain controller was asked for a Kerberos ticket-granting ticket — the event names the account, the client address the request came from, and whether the KDC issued the ticket or refused it with a result code. |
| 4771 | Kerberos pre-authentication failed. | A domain controller refused to issue a Kerberos TGT — the Failure Code says whether the password was wrong, the password expired, the account's credentials revoked, or a smart card certificate was missing. |
| 4776 | The computer attempted to validate the credentials for an account. | An NTLM credential check happened on the machine that holds the account — on a domain controller this is your single view of NTLM authentication attempts for domain accounts, and the Error Code says whether the credentials passed and, if not, why. |
Looking up a status code from one of these events? Error code lookup explains any NTSTATUS or Kerberos code.
Read a whole Security log at once
Load a Windows Security event export into the free browser analyzer: failed logons are grouped by account, source and status, with password spraying, brute force and lockout storms flagged. Nothing is uploaded.