Event ID 0x0200 (512)
Windows is starting up


Event ID 0x0201 (513)
Windows is shutting down.
All logon sessions will be terminated by this shutdown


Event ID 0x0202 (514)
An authentication package has been loaded by the Local Security Authority.
This authentication package will be used to authenticate logon attempts.
%n
Authentication Package Name:%t%1


Event ID 0x0203 (515)
A trusted logon process has registered with the Local Security Authority.
This logon process will be trusted to submit logon requests.
%n
%n
Logon Process Name:%t%1


Event ID 0x0204 (516)
Internal resources allocated for the queuing of audit messages have been exhausted,
leading to the loss of some audits.
%n
%tNumber of audit messages discarded:%t%1


Event ID 0x0205 (517)
The audit log was cleared
%n
%tPrimary User Name:%t%1%n
%tPrimary Domain:%t%2%n
%tPrimary Logon ID:%t%3%n
%tClient User Name:%t%4%n
%tClient Domain:%t%5%n
%tClient Logon ID:%t%6%n


Event ID 0x0206 (518)
An notification package has been loaded by the Security Account Manager.
This package will be notified of any account or password changes.
%n
Notification Package Name:%t%1


Event ID 0x0207 (519)
Invalid use of LPC port.%n
%tProcess ID: %1%n
%tImage File Name: %2%n
%tPrimary User Name:%t%3%n
%tPrimary Domain:%t%4%n
%tPrimary Logon ID:%t%5%n
%tClient User Name:%t%6%n
%tClient Domain:%t%7%n
%tClient Logon ID:%t%8%n
%tInvalid use: %9%n
%tServer Port Name:%t%10%n


Event ID 0x0208 (520)
The system time was changed.%n
Process ID:%t%t%1%n
Process Name:%t%t%2%n
Primary User Name:%t%3%n
Primary Domain:%t%t%4%n
Primary Logon ID:%t%t%5%n
Client User Name:%t%t%6%n
Client Domain:%t%t%7%n
Client Logon ID:%t%t%8%n
Previous Time:%t%t%10 %9%n
New Time:%t%t%12 %11%n


Event ID 0x0209 (521)
Unable to log events to security log:%n
%tStatus code:%t%t%1%n
%tValue of CrashOnAuditFail:%t%2%n


Event ID 0x020A (522)
The audit collection system has encountered an error.%n
%tComponent:%t%1%n
%tVersion:%t%2%n
%tStatus code:%t%3%n


Event ID 0x020b (523)
The security log is now %1 percent full.


Event ID 0x20c (524)
Event log auto-backup%n
%tLog:%t%1%n
%tFile:%t%2%n
%tStatus:%t%3%n


Event ID 0x0210 (528)
Successful Logon:%n
%tUser Name:%t%1%n
%tDomain:%t%t%2%n
%tLogon ID:%t%t%3%n
%tLogon Type:%t%4%n
%tLogon Process:%t%5%n
%tAuthentication Package:%t%6%n
%tWorkstation Name:%t%7%n
%tLogon GUID:%t%8%n
%tCaller User Name:%t%9%n
%tCaller Domain:%t%10%n
%tCaller Logon ID:%t%11%n
%tCaller Process ID: %12%n
%tTransited Services: %13%n
%tSource Network Address:%t%14%n
%tSource Port:%t%15%n


Event ID 0x0211 (529)
Logon Failure:%n
%tReason:%t%tUnknown user name or bad password%n
%tUser Name:%t%1%n
%tDomain:%t%t%2%n
%tLogon Type:%t%3%n
%tLogon Process:%t%4%n
%tAuthentication Package:%t%5%n
%tWorkstation Name:%t%6%n
%tCaller User Name:%t%7%n
%tCaller Domain:%t%8%n
%tCaller Logon ID:%t%9%n
%tCaller Process ID:%t%10%n
%tTransited Services:%t%11%n
%tSource Network Address:%t%12%n
%tSource Port:%t%13%n


Event ID 0x0212 (530)
Logon Failure:%n
%tReason:%t%tAccount logon time restriction violation%n
%tUser Name:%t%1%n
%tDomain:%t%t%2%n
%tLogon Type:%t%3%n
%tLogon Process:%t%4%n
%tAuthentication Package:%t%5%n
%tWorkstation Name:%t%6%n
%tCaller User Name:%t%7%n
%tCaller Domain:%t%8%n
%tCaller Logon ID:%t%9%n
%tCaller Process ID:%t%10%n
%tTransited Services:%t%11%n
%tSource Network Address:%t%12%n
%tSource Port:%t%13%n


Event ID 0x0213 (531)
Logon Failure:%n
%tReason:%t%tAccount currently disabled%n
%tUser Name:%t%1%n
%tDomain:%t%t%2%n
%tLogon Type:%t%3%n
%tLogon Process:%t%4%n
%tAuthentication Package:%t%5%n
%tWorkstation Name:%t%6%n
%tCaller User Name:%t%7%n
%tCaller Domain:%t%8%n
%tCaller Logon ID:%t%9%n
%tCaller Process ID:%t%10%n
%tTransited Services:%t%11%n
%tSource Network Address:%t%12%n
%tSource Port:%t%13%n


Event ID 0x0214 (532)
Logon Failure:%n
%tReason:%t%tThe specified user account has expired%n
%tUser Name:%t%1%n
%tDomain:%t%t%2%n
%tLogon Type:%t%3%n
%tLogon Process:%t%4%n
%tAuthentication Package:%t%5%n
%tWorkstation Name:%t%6%n
%tCaller User Name:%t%7%n
%tCaller Domain:%t%8%n
%tCaller Logon ID:%t%9%n
%tCaller Process ID:%t%10%n
%tTransited Services:%t%11%n
%tSource Network Address:%t%12%n
%tSource Port:%t%13%n


Event ID 0x0215 (533)
Logon Failure:%n
%tReason:%t%tUser not allowed to logon at this computer%n
%tUser Name:%t%1%n
%tDomain:%t%t%2%n
%tLogon Type:%t%3%n
%tLogon Process:%t%4%n
%tAuthentication Package:%t%5%n
%tWorkstation Name:%t%6%n
%tCaller User Name:%t%7%n
%tCaller Domain:%t%8%n
%tCaller Logon ID:%t%9%n
%tCaller Process ID:%t%10%n
%tTransited Services:%t%11%n
%tSource Network Address:%t%12%n
%tSource Port:%t%13%n


Event ID 0x0216 (534)
Logon Failure:%n
%tReason:%tThe user has not been granted the requested%n
%t%tlogon type at this machine%n
%tUser Name:%t%1%n
%tDomain:%t%t%2%n
%tLogon Type:%t%3%n
%tLogon Process:%t%4%n
%tAuthentication Package:%t%5%n
%tWorkstation Name:%t%6%n
%tCaller User Name:%t%7%n
%tCaller Domain:%t%8%n
%tCaller Logon ID:%t%9%n
%tCaller Process ID:%t%10%n
%tTransited Services:%t%11%n
%tSource Network Address:%t%12%n
%tSource Port:%t%13%n


Event ID 0x0217 (535)
Logon Failure:%n
%tReason:%t%tThe specified account's password has expired%n
%tUser Name:%t%1%n
%tDomain:%t%t%2%n
%tLogon Type:%t%3%n
%tLogon Process:%t%4%n
%tAuthentication Package:%t%5%n
%tWorkstation Name:%t%6%n
%tCaller User Name:%t%7%n
%tCaller Domain:%t%8%n
%tCaller Logon ID:%t%9%n
%tCaller Process ID:%t%10%n
%tTransited Services:%t%11%n
%tSource Network Address:%t%12%n
%tSource Port:%t%13%n


Event ID 0x0218 (536)
Logon Failure:%n
%tReason:%t%tThe NetLogon component is not active%n
%tUser Name:%t%1%n
%tDomain:%t%t%2%n
%tLogon Type:%t%3%n
%tLogon Process:%t%4%n
%tAuthentication Package:%t%5%n
%tWorkstation Name:%t%6%n
%tCaller User Name:%t%7%n
%tCaller Domain:%t%8%n
%tCaller Logon ID:%t%9%n
%tCaller Process ID:%t%10%n
%tTransited Services:%t%11%n
%tSource Network Address:%t%12%n
%tSource Port:%t%13%n


Event ID 0x0219 (537)
Logon Failure:%n
%tReason:%t%tAn error occurred during logon%n
%tUser Name:%t%1%n
%tDomain:%t%t%2%n
%tLogon Type:%t%3%n
%tLogon Process:%t%4%n
%tAuthentication Package:%t%5%n
%tWorkstation Name:%t%6%n
%tStatus code:%t%7%n
%tSubstatus code:%t%8%n
%tCaller User Name:%t%9%n
%tCaller Domain:%t%10%n
%tCaller Logon ID:%t%11%n
%tCaller Process ID:%t%12%n
%tTransited Services:%t%13%n
%tSource Network Address:%t%14%n
%tSource Port:%t%15%n


Event ID 0x021A (538)
User Logoff:%n
%tUser Name:%t%1%n
%tDomain:%t%t%2%n
%tLogon ID:%t%t%3%n
%tLogon Type:%t%4%n


Event ID 0x021B (539)
Logon Failure:%n
%tReason:%t%tAccount locked out%n
%tUser Name:%t%1%n
%tDomain:%t%2%n
%tLogon Type:%t%3%n
%tLogon Process:%t%4%n
%tAuthentication Package:%t%5%n
%tWorkstation Name:%t%6%n
%tCaller User Name:%t%7%n
%tCaller Domain:%t%8%n
%tCaller Logon ID:%t%9%n
%tCaller Process ID: %10%n
%tTransited Services: %11%n
%tSource Network Address:%t%12%n
%tSource Port:%t%13%n


Event ID 0x021c (540)
Successful Network Logon:%n
%tUser Name:%t%1%n
%tDomain:%t%t%2%n
%tLogon ID:%t%t%3%n
%tLogon Type:%t%4%n
%tLogon Process:%t%5%n
%tAuthentication Package:%t%6%n
%tWorkstation Name:%t%7%n
%tLogon GUID:%t%8%n
%tCaller User Name:%t%9%n
%tCaller Domain:%t%10%n
%tCaller Logon ID:%t%11%n
%tCaller Process ID: %12%n
%tTransited Services: %13%n
%tSource Network Address:%t%14%n
%tSource Port:%t%15%n


Event ID 0x021d (541)
IKE security association established.%n
Mode: %n%1%n
Peer Identity: %n%2%n
Filter: %n%3%n
Parameters: %n%4%n


Event ID 0x021e
IKE security association ended.%n
Mode: Data Protection (Quick mode)
Filter: %n%1%n
Inbound SPI: %n%2%n
Outbound SPI: %n%3%n


Event ID 0x021f
IKE security association ended.%n
Mode: Key Exchange (Main mode)%n
Filter: %n%1%n


Event ID 0x0220
IKE security association establishment failed because peer could not authenticate.
The certificate trust could not be established.%n
Peer Identity: %n%1%n
Filter: %n%2%n


Event ID 0x0221
IKE peer authentication failed.%n
Peer Identity: %n%1%n
Filter: %n%2%n


Event ID 0x0222
IKE security association establishment failed because peer
sent invalid proposal.%n
Mode: %n%1%n
Filter: %n%2%n
Attribute: %n%3%n
Expected value: %n%4%n
Received value: %n%5%n


Event ID 0x0223
IKE security association negotiation failed.%n
Mode: %n%1%n
Filter: %n%2%n
Peer Identity: %n%3%n 
Failure Point: %n%4%n
Failure Reason: %n%5%n
Extra Status: %n%6%n


Event ID 0x0224
Logon Failure:%n
%tReason:%t%tDomain sid inconsistent%n
%tUser Name:%t%1%n
%tDomain:%t%t%2%n
%tLogon Type:%t%3%n
%tLogon Process:%t%4%n
%tAuthentication Package:%t%5%n
%tWorkstation Name:%t%6
%tTransited Services:%t%7%n


Event ID 0x0225
Logon Failure:%n
%tReason: %tAll sids were filtered out%n
%tUser Name:%t%1%n
%tDomain:%t%2%n
%tLogon Type:%t%3%n
%tLogon Process:%t%4%n
%tAuthentication Package%t: %5%n
%tWorkstation Name:%t%6


Event ID 0x0226 (550)
%1%n


Event ID 0x0227 (551)
User initiated logoff:%n
%tUser Name:%t%1%n
%tDomain:%t%t%2%n
%tLogon ID:%t%t%3%n


Event ID 0x0228 (552)
Logon attempt using explicit credentials:%n
Logged on user:%n
%tUser Name:%t%1%n
%tDomain:%t%t%2%n
%tLogon ID:%t%t%3%n
%tLogon GUID:%t%4%n
User whose credentials were used:%n
%tTarget User Name:%t%5%n
%tTarget Domain:%t%6%n
%tTarget Logon GUID: %7%n%n
Target Server Name:%t%8%n
Target Server Info:%t%9%n
Caller Process ID:%t%10%n
Source Network Address:%t%11%n
Source Port:%t%12%n


Event ID 0x0229 (553)
%tUser Name:%t%1%n
%tDomain:%t%%t%2%n
%tRequest Type:%t%3%n
%tLogon Process:%t%4%n
%tAuthentication Package:%t%5%n
%tWorkstation Name:%t%6%n
%tCaller User Name:%t%7%n
%tCaller Domain:%t%8%n
%tCaller Logon ID:%t%9%n
%tCaller Process ID: %10%n
%tTransited Services: %11%n


Event ID 0x0230 (560)
Object Open:%n
%tObject Server:%t%1%n
%tObject Type:%t%2%n
%tObject Name:%t%3%n
%tHandle ID:%t%4%n
%tOperation ID:%t{%5,%6}%n
%tProcess ID:%t%7%n
%tImage File Name:%t%8%n
%tPrimary User Name:%t%9%n
%tPrimary Domain:%t%10%n
%tPrimary Logon ID:%t%11%n
%tClient User Name:%t%12%n
%tClient Domain:%t%13%n
%tClient Logon ID:%t%14%n
%tAccesses:%t%15%n
%tPrivileges:%t%16%n
%tRestricted Sid Count:%t%17%n
%tAccess Mask:%t%18%n


Event ID 0x0232 (562)
Handle Closed:%n
%tObject Server:%t%1%n
%tHandle ID:%t%2%n
%tProcess ID:%t%3%n
%tImage File Name:%t%4%n


Event ID 0x0233 (563)
Object Open for Delete:%n
%tObject Server:%t%1%n
%tObject Type:%t%2%n
%tObject Name:%t%3%n
%tHandle ID:%t%4%n
%tOperation ID:%t{%5,%6}%n
%tProcess ID:%t%7%n
%tPrimary User Name:%t%8%n
%tPrimary Domain:%t%9%n
%tPrimary Logon ID:%t%10%n
%tClient User Name:%t%11%n
%tClient Domain:%t%12%n
%tClient Logon ID:%t%13%n
%tAccesses:%t%t%14%n
%tPrivileges:%t%t%15%n
%tAccess Mask:%t%16%n


Event ID 0x0234 (564)
Object Deleted:%n
%tObject Server:%t%1%n
%tHandle ID:%t%2%n
%tProcess ID:%t%3%n
%tImage File Name:%t%4%n


Event ID 0x0235 (565)
Object Open:%n
%tObject Server:%t%1%n
%tObject Type:%t%2%n
%tObject Name:%t%3%n
%tHandle ID:%t%4%n
%tOperation ID:%t{%5,%6}%n
%tProcess ID:%t%7%n
%tProcess Name:%t%8%n
%tPrimary User Name:%t%9%n
%tPrimary Domain:%t%10%n
%tPrimary Logon ID:%t%11%n
%tClient User Name:%t%12%n
%tClient Domain:%t%13%n
%tClient Logon ID:%t%14%n
%tAccesses:%t%15%n
%tPrivileges:%t%16%n%n
%tProperties:%n%17%n
%tAccess Mask:%t%18%n


Event ID 0x0236 (566)
Object Operation:%n
%tObject Server:%t%1%n
%tOperation Type:%t%2%n
%tObject Type:%t%3%n
%tObject Name:%t%4%n
%tHandle ID:%t%5%n
%tPrimary User Name:%t%6%n
%tPrimary Domain:%t%7%n
%tPrimary Logon ID:%t%8%n
%tClient User Name:%t%9%n
%tClient Domain:%t%10%n
%tClient Logon ID:%t%11%n
%tAccesses:%t%12%n
%tProperties:%n%t%13%n
%tAdditional Info:%t%14%n
%tAdditional Info2:%t%15%n
%tAccess Mask:%t%16%n


Event ID 0x0237 (567)
Object Access Attempt:%n
%tObject Server:%t%1%n
%tHandle ID:%t%2%n
%tObject Type:%t%3%n
%tProcess ID:%t%4%n
%tImage File Name:%t%5%n
%tAccesses:%t%6%n
%tAccess Mask:%t%7%n


Event ID 0x0238 (568)
Hard link creation attempt:%n
%tPrimary User Name:%t%1%n
%tPrimary Domain:%t%2%n
%tPrimary Logon ID:%t%3%n
%tFile Name:%t%4%n
%tLink Name:%t%5%n


Event ID 0x0239 (569)
Application client context creation attempt:%n
%tApplication Name:%t%1%n
%tApplication Instance ID:%t%2%n
%tClient Name:%t%3%n
%tClient Domain:%t%4%n
%tClient Context ID:%t%5%n
%tStatus:%t%6%n


Event ID 0x023A (570)
Application operation attempt:%n
%tApplication Name:%t%1%n
%tApplication Instance ID:%t%2%n
%tObject Name:%t%3%n
%tScope Names:%t%4%n
%tClient Name:%t%5%n
%tClient Domain:%t%6%n
%tClient Context ID:%t%7%n
%tRole:%t%8%n
%tGroups:%t%9%n
%tOperation Name:%t%10 (%11)%n


Event ID 0x023B (571)
Application client context deletion:%n
%tApplication Name:%t%1%n
%tApplication Instance ID:%t%2%n
%tClient Name:%t%3%n
%tClient Domain:%t%4%n
%tClient Context ID:%t%5%n


Event ID 0x023C (572)
Application Initialized%n
%tApplication Name:%t%1%n
%tApplication Instance ID:%t%2%n
%tClient Name:%t%3%n
%tClient Domain:%t%4%n
%tClient ID:%t%5%n
%tPolicy Store URL:%t%6%n


Event ID 0x023D (573)
%nApplication-specific security event.%n
%tEvent Source:%t%1%n
%tEvent ID:%t%2%n
%t%t%3%n
%t%t%4%n
%t%t%5%n
%t%t%6%n
%t%t%7%n
%t%t%8%n
%t%t%9%n
%t%t%10%n
%t%t%11%n
%t%t%12%n
%t%t%13%n
%t%t%14%n
%t%t%15%n
%t%t%16%n
%t%t%17%n
%t%t%18%n
%t%t%19%n
%t%t%20%n
%t%t%21%n
%t%t%22%n
%t%t%23%n
%t%t%24%n
%t%t%25%n
%t%t%26%n
%t%t%27%n


Event ID 0x0240 (576)
Special privileges assigned to new logon:%n
%tUser Name:%t%1%n
%tDomain:%t%t%2%n
%tLogon ID:%t%t%3%n
%tPrivileges:%t%4


Event ID 0x0241 (577)
Privileged Service Called:%n
%tServer:%t%t%1%n
%tService:%t%t%2%n
%tPrimary User Name:%t%3%n
%tPrimary Domain:%t%4%n
%tPrimary Logon ID:%t%5%n
%tClient User Name:%t%6%n
%tClient Domain:%t%7%n
%tClient Logon ID:%t%8%n
%tPrivileges:%t%9


Event ID 0x0242 (578)
Privileged object operation:%n
%tObject Server:%t%1%n
%tObject Handle:%t%2%n
%tProcess ID:%t%3%n
%tPrimary User Name:%t%4%n
%tPrimary Domain:%t%5%n
%tPrimary Logon ID:%t%6%n
%tClient User Name:%t%7%n
%tClient Domain:%t%8%n
%tClient Logon ID:%t%9%n
%tPrivileges:%t%10



Event ID 0x0250
A new process has been created:%n
%tNew Process ID:%t%1%n
%tImage File Name:%t%2%n
%tCreator Process ID:%t%3%n
%tUser Name:%t%4%n
%tDomain:%t%t%5%n
%tLogon ID:%t%t%6%n


Event ID 0x0251
A process has exited:%n
%tProcess ID:%t%1%n
%tImage File Name:%t%2%n
%tUser Name:%t%3%n
%tDomain:%t%t%4%n
%tLogon ID:%t%t%5%n


Event ID 0x0252
A handle to an object has been duplicated:%n
%tSource Handle ID:%t%1%n
%tSource Process ID:%t%2%n
%tTarget Handle ID:%t%3%n
%tTarget Process ID:%t%4%n


Event ID 0x0253
Indirect access to an object has been obtained:%n
%tObject Type:%t%1%n
%tObject Name:%t%2%n
%tProcess ID:%t%3%n
%tPrimary User Name:%t%4%n
%tPrimary Domain:%t%5%n
%tPrimary Logon ID:%t%6%n
%tClient User Name:%t%7%n
%tClient Domain:%t%8%n
%tClient Logon ID:%t%9%n
%tAccesses:%t%10%n
%tAccess Mask:%t%11%n


Event ID 0x0254
Backup of data protection master key.
%n
%tKey Identifier:%t%t%1%n
%tRecovery Server:%t%t%2%n
%tRecovery Key ID:%t%t%3%n
%tFailure Reason:%t%t%4%n


Event ID 0x0255
Recovery of data protection master key.
%n
%tKey Identifier:%t%t%1%n
%tRecovery Reason:%t%t%3%n
%tRecovery Server:%t%t%2%n
%tRecovery Key ID:%t%t%4%n
%tFailure Reason:%t%t%5%n


Event ID 0x0256
Protection of auditable protected data.
%n
%tData Description:%t%t%2%n
%tKey Identifier:%t%t%1%n
%tProtected Data Flags:%t%3%n
%tProtection Algorithms:%t%4%n
%tFailure Reason:%t%t%5%n


Event ID 0x0257
Unprotection of auditable protected data.
%n
%tData Description:%t%t%2%n
%tKey Identifier:%t%t%1%n
%tProtected Data Flags:%t%3%n
%tProtection Algorithms:%t%4%n
%tFailure Reason:%t%t%5%n


Event ID 0x0258
A process was assigned a primary token.%n
Assigning Process Information:%n
%tProcess ID:%t%1%n
%tImage File Name:%t%2%n
%tPrimary User Name:%t%3%n
%tPrimary Domain:%t%4%n
%tPrimary Logon ID:%t%5%n
New Process Information:%n
%tProcess ID:%t%6%n
%tImage File Name:%t%7%n
%tTarget User Name:%t%8%n
%tTarget Domain:%t%9%n
%tTarget Logon ID:%t%10%n


Event ID 0x0259
Attempt to install service:%n
%tService Name:%t%1%n
%tService File Name:%t%2%n
%tService Type:%t%3%n
%tService Start Type:%t%4%n
%tService Account:%t%5%n
By:%n
%tUser Name:%t%6%n
%tDomain:%t%t%7%n
%tLogon ID:%t%t%8%n


Event ID 0x025A
Scheduled Task created:%n
%tFile Name:%t%1%n
%tCommand:%t%2%n
%tTriggers:%t%t%3%n
%tTime:%t%t%4 %5%n
%tFlags:%t%t%6%n
%tTarget User:%t%7%n
By:%n
%tUser:%t%t%8%n
%tDomain:%t%t%9%n
%tLogon ID:%t%t%10%n


Event ID 0x0260
User Right Assigned:%n
%tUser Right:%t%1%n
%tAssigned To:%t%2%n
%tAssigned By:%n
%t  User Name:%t%3%n
%t  Domain:%t%t%4%n
%t  Logon ID:%t%5%n


Event ID 0x0261
User Right Removed:%n
%tUser Right:%t%1%n
%tRemoved From:%t%2%n
%tRemoved By:%n
%t  User Name:%t%3%n
%t  Domain:%t%t%4%n
%t  Logon ID:%t%5%n


Event ID 0x0262
New Trusted Domain:%n
%tDomain Name:%t%1%n
%tDomain ID:%t%2%n
%tEstablished By:%n
%t  User Name:%t%3%n
%t  Domain:%t%t%4%n
%t  Logon ID:%t%5%n
%tTrust Type:%t%6%n
%tTrust Direction:%t%7%n
%tTrust Attributes:%t%8%n
%tSID Filtering:%t%9%n


Event ID 0x0263
Trusted Domain Removed:%n
%tDomain Name:%t%1%n
%tDomain ID:%t%2%n
%tRemoved By:%n
%t  User Name:%t%3%n
%t  Domain:%t%t%4%n
%t  Logon ID:%t%5%n


Event ID 0x0264
Audit Policy Change:%n
New Policy:%n
%tSuccess%tFailure%n
%t    %3%t    %4%tLogon/Logoff%n
%t    %5%t    %6%tObject Access%n
%t    %7%t    %8%tPrivilege Use%n
%t    %13%t    %14%tAccount Management%n
%t    %11%t    %12%tPolicy Change%n
%t    %1%t    %2%tSystem%n
%t    %9%t    %10%tDetailed Tracking%n
%t    %15%t    %16%tDirectory Service Access%n
%t    %17%t    %18%tAccount Logon%n%n
Changed By:%n
%t  User Name:%t%19%n
%t  Domain Name:%t%20%n
%t  Logon ID:%t%21


Event ID 0x0265 (613)
IPSec Services started: %t%1%n
Policy Source: %t%2%n
%3%n


Event ID 0x0266
IPSec Services disabled: %t%1%n
%2%n


Event ID 0x0267
IPSec Services: %t%1%n


Event ID 0x0268
IPSec Services encountered a potentially serious failure.%n
%1%n


Event ID 0x0269
Kerberos Policy Changed:%n
Changed By:%n
%t  User Name:%t%1%n
%t  Domain Name:%t%2%n
%t  Logon ID:%t%3%n
Changes made:%n
('--' means no changes, otherwise each change is shown as:%n
<ParameterName>: <new value> (<old value>))%n
%4%n


Event ID 0x026a
Encrypted Data Recovery Policy Changed:%n
Changed By:%n
%t  User Name:%t%1%n
%t  Domain Name:%t%2%n
%t  Logon ID:%t%3%n
Changes made:%n
('--' means no changes, otherwise each change is shown as:%n
<ParameterName>: <new value> (<old value>))%n
%4%n


Event ID 0x026C
Trusted Domain Information Modified:%n
%tDomain Name:%t%1%n
%tDomain ID:%t%2%n
%tModified By:%n
%t  User Name:%t%3%n
%t  Domain:%t%t%4%n
%t  Logon ID:%t%5%n
%tTrust Type:%t%6%n
%tTrust Direction:%t%7%n
%tTrust Attributes:%t%8%n
%tSID Filtering:%t%9%n


Event ID 0x026d
System Security Access Granted:%n
%tAccess Granted:%t%4%n
%tAccount Modified:%t%5%n
%tAssigned By:%n
%t  User Name:%t%1%n
%t  Domain:%t%t%2%n
%t  Logon ID:%t%3%n


Event ID 0x026e
System Security Access Removed:%n
%tAccess Removed:%t%4%n
%tAccount Modified:%t%5%n
%tRemoved By:%n
%t  User Name:%t%1%n
%t  Domain:%t%t%2%n
%t  Logon ID:%t%3%n


Event ID 0x0300
Namespace collision detected:%n
%tTarget type:%t%1%n
%tTarget name:%t%2%n
%tForest Root:%t%3%n
%tTop Level Name:%t%4%n
%tDNS Name:%t%5%n
%tNetBIOS Name:%t%6%n
%tSID:%t%t%7%n
%tNew Flags:%t%8%n


Event ID 0x0301
Trusted Forest Information Entry Added:%n
%tForest Root:%t%1%n
%tForest Root SID:%t%2%n
%tOperation ID:%t{%3,%4}%n
%tEntry Type:%t%5%n
%tFlags:%t%t%6%n
%tTop Level Name:%t%7%n
%tDNS Name:%t%8%n
%tNetBIOS Name:%t%9%n
%tDomain SID:%t%10%n
%tAdded by%t:%n
%tClient User Name:%t%11%n
%tClient Domain:%t%12%n
%tClient Logon ID:%t%13%n


Event ID 0x0302
Trusted Forest Information Entry Removed:%n
%tForest Root:%t%1%n
%tForest Root SID:%t%2%n
%tOperation ID:%t{%3,%4}%n
%tEntry Type:%t%5%n
%tFlags:%t%t%6%n
%tTop Level Name:%t%7%n
%tDNS Name:%t%8%n
%tNetBIOS Name:%t%9%n
%tDomain SID:%t%10%n
%tRemoved by%t:%n
%tClient User Name:%t%11%n
%tClient Domain:%t%12%n
%tClient Logon ID:%t%13%n


Event ID 0x0303
Trusted Forest Information Entry Modified:%n
%tForest Root:%t%1%n
%tForest Root SID:%t%2%n
%tOperation ID:%t{%3,%4}%n
%tEntry Type:%t%5%n
%tFlags:%t%t%6%n
%tTop Level Name:%t%7%n
%tDNS Name:%t%8%n
%tNetBIOS Name:%t%9%n
%tDomain SID:%t%10%n
%tModified by%t:%n
%tClient User Name:%t%11%n
%tClient Domain:%t%12%n
%tClient Logon ID:%t%13%n


Event ID 0x0325
Configuration of security log for this session:
%tMaximum Log Size (KB): %1%n
%tAction to take on reaching max log size: %2%n
%tEvent age limit in days: %3%n


Event ID 0x0326
Per User Audit Policy was refreshed.%n
%tNumber of elements:%t%1%n
%tPolicy ID:%t%2%n


Event ID 0x0327 (807)
Per user auditing policy set for user:%n
%tTarget user:%t%1%n
%tPolicy ID:%t%2%n
%tCategory Settings:%n
%t System:%t%3%n
%t Logon:%t%4%n
%t Object Access%t%5%n
%t Privilege Use:%t%6%n
%t Detailed Tracking:%t%7%n
%t Policy Change:%t%8%n
%t Account Management:%t%9%n
%t DS Access:%t%10%n
%t Account Logon:%t%11%n


Event ID 0x0328
A security event source has attempted to register.%n
%tPrimary User Name:%t%1%n
%tPrimary Domain:%t%2%n
%tPrimary Logon ID:%t%3%n
%tClient User Name:%t%4%n
%tClient Domain:%t%5%n
%tClient Logon ID:%t%6%n
%tSource Name:%t%7%n
%tProcess Id:%t%8%n
%tEvent Source Id:%t%9%n


Event ID 0x0329
A security event source has attempted to unregister.%n
%tPrimary User Name:%t%1%n
%tPrimary Domain:%t%2%n
%tPrimary Logon ID:%t%3%n
%tClient User Name:%t%4%n
%tClient Domain:%t%5%n
%tClient Logon ID:%t%6%n
%tSource Name:%t%7%n
%tProcess Id:%t%8%n
%tEvent Source Id:%t%9%n


Event ID 0x0270 (624)
User Account Created:%n
%tNew Account Name:%t%1%n
%tNew Domain:%t%2%n
%tNew Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges%t%t%7%n
Attributes:%n
%tSam Account Name:%t%8%n
%tDisplay Name:%t%9%n
%tUser Principal Name:%t%10%n
%tHome Directory:%t%11%n
%tHome Drive:%t%12%n
%tScript Path:%t%13%n
%tProfile Path:%t%14%n
%tUser Workstations:%t%15%n
%tPassword Last Set:%t%16%n
%tAccount Expires:%t%17%n
%tPrimary Group ID:%t%18%n
%tAllowedToDelegateTo:%t%19%n
%tOld UAC Value:%t%20%n
%tNew UAC Value:%t%21%n
%tUser Account Control:%t%22%n
%tUser Parameters:%t%23%n
%tSid History:%t%24%n
%tLogon Hours:%t%25%n


Event ID 0x0272 (626)
User Account Enabled:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n


Event ID 0x0273 (627)
Change Password Attempt:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n


Event ID 0x0274 (628)
User Account password set:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n


Event ID 0x0275 (629)
User Account Disabled:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n


Event ID 0x0276 (630)
User Account Deleted:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n


Event ID 0x0277 (631)
Security Enabled Global Group Created:%n
%tNew Account Name:%t%1%n
%tNew Domain:%t%2%n
%tNew Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n
Attributes:%n
%tSam Account Name:%t%8%n
%tSid History:%t%9%n


Event ID 0x0278 (632)
Security Enabled Global Group Member Added:%n
%tMember Name:%t%1%n
%tMember ID:%t%2%n
%tTarget Account Name:%t%3%n
%tTarget Domain:%t%4%n
%tTarget Account ID:%t%5%n
%tCaller User Name:%t%6%n
%tCaller Domain:%t%7%n
%tCaller Logon ID:%t%8%n
%tPrivileges:%t%9%n


Event ID 0x0279 (633)
Security Enabled Global Group Member Removed:%n
%tMember Name:%t%1%n
%tMember ID:%t%2%n
%tTarget Account Name:%t%3%n
%tTarget Domain:%t%4%n
%tTarget Account ID:%t%5%n
%tCaller User Name:%t%6%n
%tCaller Domain:%t%7%n
%tCaller Logon ID:%t%8%n
%tPrivileges:%t%9%n


Event ID 0x027A (634)
Security Enabled Global Group Deleted:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n


Event ID 0x027B (635)
Security Enabled Local Group Created:%n
%tNew Account Name:%t%1%n
%tNew Domain:%t%2%n
%tNew Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n
Attributes:%n
%tSam Account Name:%t%8%n
%tSid History:%t%9%n


Event ID 0x027C (636)
Security Enabled Local Group Member Added:%n
%tMember Name:%t%1%n
%tMember ID:%t%2%n
%tTarget Account Name:%t%3%n
%tTarget Domain:%t%4%n
%tTarget Account ID:%t%5%n
%tCaller User Name:%t%6%n
%tCaller Domain:%t%7%n
%tCaller Logon ID:%t%8%n
%tPrivileges:%t%9%n


Event ID 0x027D (637)
Security Enabled Local Group Member Removed:%n
%tMember Name:%t%1%n
%tMember ID:%t%2%n
%tTarget Account Name:%t%3%n
%tTarget Domain:%t%4%n
%tTarget Account ID:%t%5%n
%tCaller User Name:%t%6%n
%tCaller Domain:%t%7%n
%tCaller Logon ID:%t%8%n
%tPrivileges:%t%9%n


Event ID 0x027E (638)
Security Enabled Local Group Deleted:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n


Event ID 0x027F (639)
Security Enabled Local Group Changed:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n
Changed Attributes:%n
%tSam Account Name:%t%8%n
%tSid History:%t%9%n


Event ID 0x0280 (640)
General Account Database Change:%n
%tType of change:%t%1%n
%tObject Type:%t%2%n
%tObject Name:%t%3%n
%tObject ID:%t%4%n
%tCaller User Name:%t%5%n
%tCaller Domain:%t%6%n
%tCaller Logon ID:%t%7%n


Event ID 0x0281 (641)
Security Enabled Global Group Changed:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n
Changed Attributes:%n
%tSam Account Name:%t%8%n
%tSid History:%t%9%n


Event ID 0x0282 (642)
User Account Changed:%n
%tTarget Account Name:%t%2%n
%tTarget Domain:%t%3%n
%tTarget Account ID:%t%4%n
%tCaller User Name:%t%5%n
%tCaller Domain:%t%6%n
%tCaller Logon ID:%t%7%n
%tPrivileges:%t%8%n
Changed Attributes:%n
%tSam Account Name:%t%9%n
%tDisplay Name:%t%10%n
%tUser Principal Name:%t%11%n
%tHome Directory:%t%12%n
%tHome Drive:%t%13%n
%tScript Path:%t%14%n
%tProfile Path:%t%15%n
%tUser Workstations:%t%16%n
%tPassword Last Set:%t%17%n
%tAccount Expires:%t%18%n
%tPrimary Group ID:%t%19%n
%tAllowedToDelegateTo:%t%20%n
%tOld UAC Value:%t%21%n
%tNew UAC Value:%t%22%n
%tUser Account Control:%t%23%n
%tUser Parameters:%t%24%n
%tSid History:%t%25%n
%tLogon Hours:%t%26%n


Event ID 0x0283 (643)
Domain Policy Changed: %1 modified%n
%tDomain Name:%t%t%2%n
%tDomain ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n
Changed Attributes:%n
%tMin. Password Age:%t%8%n
%tMax. Password Age:%t%9%n
%tForce Logoff:%t%10%n
%tLockout Threshold:%t%11%n
%tLockout Observation Window:%t%12%n
%tLockout Duration:%t%13%n
%tPassword Properties:%t%14%n
%tMin. Password Length:%t%15%n
%tPassword History Length:%t%16%n
%tMachine Account Quota:%t%17%n  
%tMixed Domain Mode:%t%18%n
%tDomain Behavior Version:%t%19%n
%tOEM Information:%t%20%n


Event ID 0x0284 (644)
User Account Locked Out:%n
%tTarget Account Name:%t%1%n
%tTarget Account ID:%t%3%n
%tCaller Machine Name:%t%2%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n


Event ID 0x0285 (645)
Computer Account Created:%n
%tNew Account Name:%t%1%n
%tNew Domain:%t%2%n
%tNew Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges%t%t%7%n
Attributes:%n
%tSam Account Name:%t%8%n
%tDisplay Name:%t%9%n
%tUser Principal Name:%t%10%n
%tHome Directory:%t%11%n
%tHome Drive:%t%12%n
%tScript Path:%t%13%n
%tProfile Path:%t%14%n
%tUser Workstations:%t%15%n
%tPassword Last Set:%t%16%n
%tAccount Expires:%t%17%n
%tPrimary Group ID:%t%18%n
%tAllowedToDelegateTo:%t%19%n
%tOld UAC Value:%t%20%n
%tNew UAC Value:%t%21%n
%tUser Account Control:%t%22%n
%tUser Parameters:%t%23%n
%tSid History:%t%24%n
%tLogon Hours:%t%25%n
%tDNS Host Name:%t%26%n
%tService Principal Names:%t%27%n 


Event ID 0x0286 (646)
Computer Account Changed:%n
%t%1%n
%tTarget Account Name:%t%2%n
%tTarget Domain:%t%3%n
%tTarget Account ID:%t%4%n
%tCaller User Name:%t%5%n
%tCaller Domain:%t%6%n
%tCaller Logon ID:%t%7%n
%tPrivileges:%t%8%n
Changed Attributes:%n
%tSam Account Name:%t%9%n
%tDisplay Name:%t%10%n
%tUser Principal Name:%t%11%n
%tHome Directory:%t%12%n
%tHome Drive:%t%13%n
%tScript Path:%t%14%n
%tProfile Path:%t%15%n
%tUser Workstations:%t%16%n
%tPassword Last Set:%t%17%n
%tAccount Expires:%t%18%n
%tPrimary Group ID:%t%19%n
%tAllowedToDelegateTo:%t%20%n
%tOld UAC Value:%t%21%n
%tNew UAC Value:%t%22%n
%tUser Account Control:%t%23%n
%tUser Parameters:%t%24%n
%tSid History:%t%25%n
%tLogon Hours:%t%26%n
%tDNS Host Name:%t%27%n
%tService Principal Names:%t%28%n 


Event ID 0x0287 (647)
Computer Account Deleted:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n


Event ID 0x0288 (648)
Security Disabled Local Group Created:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n
Attributes:%n
%tSam Account Name:%t%8%n
%tSid History:%t%9%n


Event ID 0x0289 (649)
Security Disabled Local Group Changed:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n
Changed Attributes:%n
%tSam Account Name:%t%8%n
%tSid History:%t%9%n


Event ID 0x028A (650)
Security Disabled Local Group Member Added:%n
%tMember Name:%t%1%n
%tMember ID:%t%2%n
%tTarget Account Name:%t%3%n
%tTarget Domain:%t%4%n
%tTarget Account ID:%t%5%n
%tCaller User Name:%t%6%n
%tCaller Domain:%t%7%n
%tCaller Logon ID:%t%8%n
%tPrivileges:%t%9%n


Event ID 0x028B (651)
Security Disabled Local Group Member Removed:%n
%tMember Name:%t%1%n
%tMember ID:%t%2%n
%tTarget Account Name:%t%3%n
%tTarget Domain:%t%4%n
%tTarget Account ID:%t%5%n
%tCaller User Name:%t%6%n
%tCaller Domain:%t%7%n
%tCaller Logon ID:%t%8%n
%tPrivileges:%t%9%n


Event ID 0x028C (652)
Security Disabled Local Group Deleted:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n


Event ID 0x028D (653)
Security Disabled Global Group Created:%n
%tNew Account Name:%t%1%n
%tNew Domain:%t%2%n
%tNew Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n
Attributes:%n
%tSam Account Name:%t%8%n
%tSid History:%t%9%n


Event ID 0x028E (654)
Security Disabled Global Group Changed:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n
Changed Attributes:%n
%tSam Account Name:%t%8%n
%tSid History:%t%9%n


Event ID 0x028F (655)
Security Disabled Global Group Member Added:%n
%tMember Name:%t%1%n
%tMember ID:%t%2%n
%tTarget Account Name:%t%3%n
%tTarget Domain:%t%4%n
%tTarget Account ID:%t%5%n
%tCaller User Name:%t%6%n
%tCaller Domain:%t%7%n
%tCaller Logon ID:%t%8%n
%tPrivileges:%t%9%n


Event ID 0x0290 (656)
Security Disabled Global Group Member Removed:%n
%tMember Name:%t%1%n
%tMember ID:%t%2%n
%tTarget Account Name:%t%3%n
%tTarget Domain:%t%4%n
%tTarget Account ID:%t%5%n
%tCaller User Name:%t%6%n
%tCaller Domain:%t%7%n
%tCaller Logon ID:%t%8%n
%tPrivileges:%t%9%n


Event ID 0x0291 (657)
Security Disabled Global Group Deleted:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n


Event ID 0x0292 (658)
Security Enabled Universal Group Created:%n
%tNew Account Name:%t%1%n
%tNew Domain:%t%2%n
%tNew Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n
Attributes:%n
%tSam Account Name:%t%8%n
%tSid History:%t%9%n


Event ID 0x0293 (659)
Security Enabled Universal Group Changed:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n
Changed Attributes:%n
%tSam Account Name:%t%8%n
%tSid History:%t%9%n


Event ID 0x0294 (660)
Security Enabled Universal Group Member Added:%n
%tMember Name:%t%1%n
%tMember ID:%t%2%n
%tTarget Account Name:%t%3%n
%tTarget Domain:%t%4%n
%tTarget Account ID:%t%5%n
%tCaller User Name:%t%6%n
%tCaller Domain:%t%7%n
%tCaller Logon ID:%t%8%n
%tPrivileges:%t%9%n


Event ID 0x0295 (661)
Security Enabled Universal Group Member Removed:%n
%tMember Name:%t%1%n
%tMember ID:%t%2%n
%tTarget Account Name:%t%3%n
%tTarget Domain:%t%4%n
%tTarget Account ID:%t%5%n
%tCaller User Name:%t%6%n
%tCaller Domain:%t%7%n
%tCaller Logon ID:%t%8%n
%tPrivileges:%t%9%n


Event ID 0x0296 (662)
Security Enabled Universal Group Deleted:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n


Event ID 0x0297 (663)
Security Disabled Universal Group Created:%n
%tNew Account Name:%t%1%n
%tNew Domain:%t%2%n
%tNew Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n
Attributes:%n
%tSam Account Name:%t%8%n
%tSid History:%t%9%n


Event ID 0x0298 (664)
Security Disabled Universal Group Changed:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n
Changed Attributes:%n
%tSam Account Name:%t%8%n
%tSid History:%t%9%n


Event ID 0x0299 (665)
Security Disabled Universal Group Member Added:%n
%tMember Name:%t%1%n
%tMember ID:%t%2%n
%tTarget Account Name:%t%3%n
%tTarget Domain:%t%4%n
%tTarget Account ID:%t%5%n
%tCaller User Name:%t%6%n
%tCaller Domain:%t%7%n
%tCaller Logon ID:%t%8%n
%tPrivileges:%t%9%n


Event ID 0x029A (666)
Security Disabled Universal Group Member Removed:%n
%tMember Name:%t%1%n
%tMember ID:%t%2%n
%tTarget Account Name:%t%3%n
%tTarget Domain:%t%4%n
%tTarget Account ID:%t%5%n
%tCaller User Name:%t%6%n
%tCaller Domain:%t%7%n
%tCaller Logon ID:%t%8%n
%tPrivileges:%t%9%n


Event ID 0x029B (667)
Security Disabled Universal Group Deleted:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n


Event ID 0x029C (668)
Group Type Changed:%n
%t%1%n
%tTarget Account Name:%t%2%n
%tTarget Domain:%t%3%n
%tTarget Account ID:%t%4%n
%tCaller User Name:%t%5%n
%tCaller Domain:%t%6%n
%tCaller Logon ID:%t%7%n
%tPrivileges:%t%8%n


Event ID 0x029D (669)
Add SID History:%n
%tSource Account Name:%t%1%n
%tSource Account ID:%t%2%n
%tTarget Account Name:%t%3%n
%tTarget Domain:%t%4%n
%tTarget Account ID:%t%5%n
%tCaller User Name:%t%6%n
%tCaller Domain:%t%7%n
%tCaller Logon ID:%t%8%n
%tPrivileges:%t%9%n
%tSidList:%t%10%n


Event ID 0x029E (670)
Add SID History:%n
%tSource Account Name:%t%1%n
%tTarget Account Name:%t%2%n
%tTarget Domain:%t%3%n
%tTarget Account ID:%t%4%n
%tCaller User Name:%t%5%n
%tCaller Domain:%t%6%n
%tCaller Logon ID:%t%7%n
%tPrivileges:%t%8%n


Event ID 0x029F (671)
User Account Unlocked:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n


Event ID 0x02AC (684)
Set ACLs of members in administrators groups:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n


Event ID 0x02AD
Account Name Changed:%n 
%tOld Account Name:%t%1%n
%tNew Account Name:%t%2%n
%tTarget Domain:%t%t%3%n
%tTarget Account ID:%t%4%n
%tCaller User Name:%t%5%n
%tCaller Domain:%t%6%n
%tCaller Logon ID:%t%7%n
%tPrivileges:%t%8%n


Event ID 0x02AE
Password of the following user accessed:%n
%tTarget User Name:%t%1%n
%tTarget User Domain:%t%t%2%n
By user:%n
%tCaller User Name:%t%3%n
%tCaller Domain:%t%t%4%n
%tCaller Logon ID:%t%t%5%n


Event ID 0x02AF
Basic Application Group Created:%n
%tNew Account Name:%t%1%n
%tNew Domain:%t%2%n
%tNew Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n
Attributes:%n
%tSam Account Name:%t%8%n
%tSid History:%t%9%n


Event ID 0x02B0
Basic Application Group Changed:%n
%tNew Account Name:%t%1%n
%tNew Domain:%t%2%n
%tNew Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n
Changed Attributes:%n
%tSam Account Name:%t%8%n
%tSid History:%t%9%n


Event ID 0x02B1
Basic Application Group Member Added:%n
%tMember Name:%t%1%n
%tMember ID:%t%2%n
%tTarget Account Name:%t%3%n
%tTarget Domain:%t%4%n
%tTarget Account ID:%t%5%n
%tCaller User Name:%t%6%n
%tCaller Domain:%t%7%n
%tCaller Logon ID:%t%8%n
%tPrivileges:%t%9%n


Event ID 0x02B2
Basic Application Group Member Removed:%n
%tMember Name:%t%1%n
%tMember ID:%t%2%n
%tTarget Account Name:%t%3%n
%tTarget Domain:%t%4%n
%tTarget Account ID:%t%5%n
%tCaller User Name:%t%6%n
%tCaller Domain:%t%7%n
%tCaller Logon ID:%t%8%n
%tPrivileges:%t%9%n


Event ID 0x02B3
Basic Application Group Non-Member Added:%n
%tMember Name:%t%1%n
%tMember ID:%t%2%n
%tTarget Account Name:%t%3%n
%tTarget Domain:%t%4%n
%tTarget Account ID:%t%5%n
%tCaller User Name:%t%6%n
%tCaller Domain:%t%7%n
%tCaller Logon ID:%t%8%n
%tPrivileges:%t%9%n


Event ID 0x02B4
Basic Application Group Non-Member Removed:%n
%tMember Name:%t%1%n
%tMember ID:%t%2%n
%tTarget Account Name:%t%3%n
%tTarget Domain:%t%4%n
%tTarget Account ID:%t%5%n
%tCaller User Name:%t%6%n
%tCaller Domain:%t%7%n
%tCaller Logon ID:%t%8%n
%tPrivileges:%t%9%n


Event ID 0x02B5
Basic Application Group Deleted:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n


Event ID 0x02B6
LDAP Query Group Created:%n
%tNew Account Name:%t%1%n
%tNew Domain:%t%2%n
%tNew Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n
Attributes:%n
%tSam Account Name:%t%8%n
%tSid History:%t%9%n


Event ID 0x02B7
LDAP Query Group Changed:%n
%tNew Account Name:%t%1%n
%tNew Domain:%t%2%n
%tNew Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n
Changed Attributes:%n
%tSam Account Name:%t%8%n
%tSid History:%t%9%n


Event ID 0x02B8
LDAP Query Group Deleted:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n


Event ID 0x02B9
Password Policy Checking API is called:%n
%tCaller Username:%t%1%n
%tCaller Domain:%t%2%n
%tCaller Logon ID:%t%3%n
%tCaller Workstation:%t%4%n
%tProvided User Name (unauthenticated):%t%5%n
%tStatus Code:%t%6%n


Event ID 0x02BA
An attempt to set the Directory Services Restore Mode 
administrator password has been made.%n
%tCaller Username:%t%1%n
%tCaller Domain:%t%2%n
%tCaller Logon ID:%t%3%n
%tCaller Workstation:%t%4%n
%tStatus Code:%t%5%n


Event ID 0x0340
%tDestination DRA:%t%1%n
%tSource DRA:%t%2%n
%tSource Addr:%t%3%n
%tNaming Context:%t%4%n
%tOptions:%t%5%n
%tStatus Code:%t%6%n


Event ID 0x0341
%tDestination DRA:%t%1%n
%tSource DRA:%t%2%n
%tSource Addr:%t%3%n
%tNaming Context:%t%4%n
%tOptions:%t%5%n
%tStatus Code:%t%6%n


Event ID 0x0342
%tDestination DRA:%t%1%n
%tSource DRA:%t%2%n
%tSource Addr:%t%3%n
%tNaming Context:%t%4%n
%tOptions:%t%5%n
%tStatus Code:%t%6%n


Event ID 0x0343
%tDestination DRA:%t%1%n
%tSource DRA:%t%2%n
%tDest. Addr:%t%3%n
%tNaming Context:%t%4%n
%tOptions:%t%5%n
%tStatus Code:%t%6%n


Event ID 0x0344
%tDestination DRA:%t%1%n
%tSource DRA:%t%2%n
%tNaming Context:%t%3%n
%tOptions:%t%4%n
%tSession ID:%t%5%n
%tStart USN:%t%6%n


Event ID 0x0345
%tDestination DRA:%t%1%n
%tSource DRA:%t%2%n
%tNaming Context:%t%3%n
%tOptions:%t%4%n
%tSession ID:%t%5%n
%tEnd USN:%t%6%n
%tStatus Code:%t%7%n


Event ID 0x0346
%tSession ID:%t%1%n
%tObject:%t%2%n
%tAttribute:%t%3%n
%tType of change:%t%4%n
%tNew Value:%t%5%n
%tUSN:%t%6%n
%tStatus Code:%t%7%n


Event ID 0x0347
%tReplication Event:%t%1%n
%tAudit Status Code:%t%2%n


Event ID 0x0348
%tReplication Event:%t%1%n
%tAudit Status Code:%t%2%n
%tReplication Status Code:%t%3%n


Event ID 0x0349
%tDestination DRA:%t%1%n
%tSource DRA:%t%2%n
%tObject:%t%3%n
%tOptions:%t%4%n
%tStatus Code:%t%5%n


Event ID 0x02a0 (672)
Authentication Ticket Request:%n
%tUser Name:%t%t%1%n
%tSupplied Realm Name:%t%2%n
%tUser ID:%t%t%t%3%n
%tService Name:%t%t%4%n
%tService ID:%t%t%5%n
%tTicket Options:%t%t%6%n
%tResult Code:%t%t%7%n
%tTicket Encryption Type:%t%8%n
%tPre-Authentication Type:%t%9%n
%tClient Address:%t%t%10%n
%tCertificate Issuer Name:%t%11%n
%tCertificate Serial Number:%t%12%n
%tCertificate Thumbprint:%t%13%n


Event ID 0x02a4 (676)
Authentication Ticket Request Failed:%n
%tUser Name:%t%1%n
%tSupplied Realm Name:%t%2%n
%tService Name:%t%3%n
%tTicket Options:%t%4%n
%tFailure Code:%t%5%n
%tClient Address:%t%6%n


Event ID 0x02a1 (673)
Service Ticket Request:%n
%tUser Name:%t%t%1%n
%tUser Domain:%t%t%2%n
%tService Name:%t%t%3%n
%tService ID:%t%t%4%n
%tTicket Options:%t%t%5%n
%tTicket Encryption Type:%t%6%n
%tClient Address:%t%t%7%n
%tFailure Code:%t%t%8%n
%tLogon GUID:%t%t%9%n
%tTransited Services:%t%10%n


Event ID 0x02a2 (674)
Service Ticket Renewed:%n
%tUser Name:%t%1%n
%tUser Domain:%t%2%n
%tService Name:%t%3%n
%tService ID:%t%4%n
%tTicket Options:%t%5%n
%tTicket Encryption Type:%t%6%n
%tClient Address:%t%7%n


Event ID 0x02a3 (675)
Pre-authentication failed:%n
%tUser Name:%t%1%n
%tUser ID:%t%t%2%n
%tService Name:%t%3%n
%tPre-Authentication Type:%t%4%n
%tFailure Code:%t%5%n
%tClient Address:%t%6%n


Event ID 0x02a5
Service Ticket Request Failed:%n
%tUser Name:%t%1%n
%tUser Domain:%t%2%n
%tService Name:%t%3%n
%tTicket Options:%t%4%n
%tFailure Code:%t%5%n
%tClient Address:%t%6%n


Event ID 0x02a6
Account Mapped for Logon.%n
Mapping Attempted By:%n 
%t%1%n
Client Name:%n
%t%2%n
%tMapped Name:%n
%t%3%n


Event ID 0x02a7
The name:%n
%t%2%n
could not be mapped for logon by:
%t%1%n


Event ID 0x02a8
Logon attempt by:%t%1%n
Logon account:%t%2%n
Source Workstation:%t%3%n
Error Code:%t%4%n


Event ID 0x02a9
The logon to account: %2%n
by: %1%n
from workstation: %3%n
failed. The error code was: %4%n


Event ID 0x02aa
Session reconnected to winstation:%n
%tUser Name:%t%1%n
%tDomain:%t%t%2%n
%tLogon ID:%t%t%3%n
%tSession Name:%t%4%n
%tClient Name:%t%5%n
%tClient Address:%t%6


Event ID 0x02ab
Session disconnected from winstation:%n
%tUser Name:%t%1%n
%tDomain:%t%t%2%n
%tLogon ID:%t%t%3%n
%tSession Name:%t%4%n
%tClient Name:%t%5%n
%tClient Address:%t%6


Event ID 0x0304
The certificate manager denied a pending certificate request.%n
%n
Request ID:%t%1


Event ID 0x0305
Certificate Services received a resubmitted certificate request.%n
%n
Request ID:%t%1


Event ID 0x0306
Certificate Services revoked a certificate.%n
%n
Serial No:%t%1%n
Reason:%t%2


Event ID 0x0307
Certificate Services received a request to publish the certificate revocation list (CRL).%n
%n
Next Update:%t%1%n
Publish Base:%t%2%n
Publish Delta:%t%3


Event ID 0x0308
Certificate Services published the certificate revocation list (CRL).%n
%n
Base CRL:%t%1%n
CRL No:%t%t%2%n
Key Container:%t%3%n
Next Publish:%t%4%n
Publish URLs:%t%5


Event ID 0x0309
A certificate request extension changed.%n
%n
Request ID:%t%1%n
Name:%t%2%n
Type:%t%3%n
Flags:%t%4%n
Data:%t%5


Event ID 0x030a
One or more certificate request attributes changed.%n
%n
Request ID:%t%1%n
Attributes:%t%2


Event ID 0x030b
Certificate Services received a request to shut down.


Event ID 0x030c
Certificate Services backup started.%n
Backup Type:%t%1


Event ID 0x030d
Certificate Services backup completed.


Event ID 0x030e
 Certificate Services restore started.


Event ID 0x030f
Certificate Services restore completed.


Event ID 0x0310
Certificate Services started.%n
%n
Certificate Database Hash:%t%1%n
Private Key Usage Count:%t%2%n
CA Certificate Hash:%t%3%n
CA Public Key Hash:%t%4


Event ID 0x0311
Certificate Services stopped.%n
%n
Certificate Database Hash:%t%1%n
Private Key Usage Count:%t%2%n
CA Certificate Hash:%t%3%n
CA Public Key Hash:%t%4


Event ID 0x0312
The security permissions for Certificate Services changed.%n
%n
%1


Event ID 0x0313
Certificate Services retrieved an archived key.%n
%n
Request ID:%t%1


Event ID 0x0314
Certificate Services imported a certificate into its database.%n
%n
Certificate:%t%1%n
Request ID:%t%2


Event ID 0x0315
The audit filter for Certificate Services changed.%n
%n
Filter:%t%1


Event ID 0x0316
Certificate Services received a certificate request.%n
%n
Request ID:%t%1%n
Requester:%t%2%n
Attributes:%t%3


Event ID 0x0317
Certificate Services approved a certificate request and issued a certificate.%n
%n
Request ID:%t%1%n
Requester:%t%2%n
Attributes:%t%3%n
Disposition:%t%4%n
SKI:%t%t%5%n
Subject:%t%6


Event ID 0x0318
Certificate Services denied a certificate request.%n
%n
Request ID:%t%1%n
Requester:%t%2%n
Attributes:%t%3%n
Disposition:%t%4%n
SKI:%t%t%5%n
Subject:%t%6


Event ID 0x0319
Certificate Services set the status of a certificate request to pending.%n
%n
Request ID:%t%1%n
Requester:%t%2%n
Attributes:%t%3%n
Disposition:%t%4%n
SKI:%t%t%5%n
Subject:%t%6


Event ID 0x031a
The certificate manager settings for Certificate Services changed.%n
%n
Enable:%t%1%n
%n
%2


Event ID 0x031b
A configuration entry changed in Certificate Services.%n
%n
Node:%t%1%n
Entry:%t%2%n
Value:%t%3


Event ID 0x031c
A property of Certificate Services changed.%n
%n
Property:%t%1%n
Index:%t%2%n
Type:%t%3%n
Value:%t%4


Event ID 0x031d
Certificate Services archived a key.%n
%n
Request ID:%t%1%n
Requester:%t%2%n
KRA Hashes:%t%3


Event ID 0x031e
Certificate Services imported and archived a key.%n
%n
Request ID:%t%1


Event ID 0x031f
Certificate Services published the CA certificate to Active Directory.%n
%n
Certificate Hash:%t%1%n
Valid From:%t%2%n
Valid To:%t%3


Event ID 0x0320
One or more rows have been deleted from the certificate database.%n
%n
Table ID:%t%1%n
Filter:%t%2%n
Rows Deleted:%t%3


Event ID 0x0321
Role separation enabled:%t%1