← cd ~/tools
// events
Event IDs explained
123 Windows, Entra and Intune event IDs, each with what it means, what to check, and the PowerShell and KQL to find it. Prefer to search? Use the event ID lookup.
Sign-in
- 4624 An account was successfully logged on
- 4625 An account failed to log on
- 4634 An account was logged off
- 4647 User initiated logoff
- 4648 A logon was attempted using explicit credentials
- 4672 Special privileges assigned to new logon
- 4776 The computer attempted to validate the credentials for an account
Accounts
- 4720 A user account was created
- 4722 A user account was enabled
- 4723 An attempt was made to change an account's password
- 4724 An attempt was made to reset an account's password
- 4725 A user account was disabled
- 4726 A user account was deleted
- 4738 A user account was changed
- 4740 A user account was locked out
- 4741 A computer account was created
- 4743 A computer account was deleted
- 4765 SID History was added to an account
- 4767 A user account was unlocked
- 4781 The name of an account was changed
Groups
- 4728 A member was added to a security-enabled global group
- 4729 A member was removed from a security-enabled global group
- 4732 A member was added to a security-enabled local group
- 4733 A member was removed from a security-enabled local group
- 4756 A member was added to a security-enabled universal group
- 4757 A member was removed from a security-enabled universal group
Kerberos
- 4 KRB_AP_ERR_MODIFIED from the server
- 4768 A Kerberos authentication ticket (TGT) was requested
- 4769 A Kerberos service ticket was requested
- 4771 Kerberos pre-authentication failed
Audit log
Netlogon
Hybrid join
- 201 Hybrid join discover phase error
- 204 Hybrid join join-phase error
- 220 Cannot read the computer object in Active Directory
- 304 Hybrid join failed (phase and error code)
- 305 Hybrid join authentication error
- 307 Hybrid join failure event
Primary Refresh Token
- 1006 PRT acquisition started
- 1007 PRT acquisition finished (final error code)
- 1022 URL being accessed
- 1081 Error from the Microsoft Entra authentication service
- 1084 Network error reaching an endpoint
- 1088 Error from the WS-Trust (federation) endpoint
- 1098 Token broker operation failed (0xCAA5001C)
- 1144 UPN provided for sign-in
Windows Hello
- 107 KDC certificate does not have a matched domain name
- 300 Windows Hello for Business key created and registered
- 358 Device ready to enrol in Windows Hello for Business
- 362 Windows Hello for Business provisioning will not be launched
- 1021 Client forbidden access to the ugs scope
- 7001 Windows Hello for Business sign-in error
Intune MDM
- 75 Auto MDM Enroll: Succeeded
- 76 Auto MDM Enroll: Failed
- 102 Auto-enrolment task completed
- 107 Auto-enrolment task triggered
- 306 SCEP certificate profile received (CspExecute)
- 400 MDM ConfigurationManager: Command failure status
- 401 MDM ConfigurationManager: CSP Node Operation
- 1506 WiFiConfigurationServiceProvider: Node set value
- 7016 Auto-enrolment task did not start
- 30132 Failed to get the ODJ blob
Intune connector
- 10010 Connector service started
- 10020 Connector service stopped
- 10100 Connector certificate renewed
- 10102 Connector certificate renewal failed
- 10301 Retrieve certificate warning
- 10302 Retrieve certificate error
- 20100 PKCS certificate issued
- 20102 PKCS certificate issue failed
- 20202 Certificate revocation failed
- 20302 Upload failed
- 20402 Download failed
- 20501 CRP rejected a SCEP challenge
- 20502 CRP failed to verify a SCEP challenge
- 20602 CRP notify failed
LAPS
- 10003 LAPS policy processing started
- 10004 LAPS policy processing succeeded
- 10005 LAPS policy processing failed
- 10018 Password backed up to Active Directory
- 10020 Local account password updated
- 10021 Policy configuration: Active Directory backup
- 10022 Policy configuration: Microsoft Entra ID backup
- 10023 Policy configuration: legacy Microsoft LAPS
- 10029 Password backed up to Microsoft Entra ID
- 10031 External password change blocked
- 10041 Managed account authentication detected
- 10042 Post-authentication grace period expired
- 10043 Post-authentication password reset failed
- 10044 Post-authentication password reset succeeded
BitLocker
- 778 Volume reverted to an unprotected state
- 796 Normal BitLocker operation event
- 845 Normal BitLocker operation event
- 846 Failed to back up recovery information to Entra ID
- 851 Failed to enable silent encryption
- 853 Compatible TPM not found, or bootable media detected
- 854 WinRE is not configured
Entra Connect
- 0 Password changes failed and scheduled for retry
- 115 Access to Entra ID denied
- 601 Password hash sync manager starting
- 607 Password hash sync could not start
- 609 Password hash sync stopped
- 611 Error during password hash sync for a domain
- 613 Paused: full sync not completed
- 616 Connection to preferred DC failed
- 617 Full password hash sync started for forest
- 621 Full password hash sync attempt failed
- 622 Full password hash sync completed for a domain
- 623 Full password hash sync completed for a forest
- 650 Password hash sync batch started
- 651 Password hash sync batch ended
- 652 Error during password hash sync operation
- 653 Password hash sync heartbeat started
- 654 Password hash sync heartbeat ended
- 655 Error during password hash sync heartbeat
- 656 Password change request
- 657 Password change result
- 662 Password hash sync health task failed during ping
- 663 Password hash sync manager alive
- 664 Single object sync task failed
- 666 Failed due to SQL deadlock
- 906 MSAL token acquisition via certificate failed
- 6900 Unexpected error processing a password change notification