1100

The event logging service has shut down

1102

The audit log was cleared

1108

The event logging service encountered an error

4608

Windows is starting up

4609

Windows is shutting down

4616

The system time was changed

4624

An account was successfully logged on

4625

An account failed to log on

4634

An account was logged off

4688

A new process has been created

4689

A process has exited

4698

A scheduled task was created

4699

A scheduled task was deleted

4700

A scheduled task was enabled

4701

A scheduled task was disabled

4702

A scheduled task was updated

4704

A user right was assigned

4705

A user right was removed

4715

The audit policy (SACL) on an object was changed

4719

System audit policy was changed

4720

A user account was created

4722

A user account was enabled

4723

An attempt was made to change an account's password

4724

An attempt was made to reset an accounts password

4725

A user account was disabled

4726

A user account was deleted

4727

A security-enabled global group was created

4728

A member was added to a security-enabled global group

4729

A member was removed from a security-enabled global group

4730

A security-enabled global group was deleted

4731

A security-enabled local group was created

4732

A member was added to a security-enabled local group

4733

A member was removed from a security-enabled local group

4734

A security-enabled local group was deleted

4735

A security-enabled local group was changed

4737

A security-enabled global group was changed

4738

A user account was changed

4739

Domain Policy was changed

4740

A user account was locked out

4741

A computer account was created

4742

A computer account was changed

4743

A computer account was deleted

4744

A security-disabled local group was created

4745

A security-disabled local group was changed

4746

A member was added to a security-disabled local group

4747

A member was removed from a security-disabled local group

4748

A security-disabled local group was deleted

4749

A security-disabled global group was created

4750

A security-disabled global group was changed

4751

A member was added to a security-disabled global group

4752

A member was removed from a security-disabled global group

4753

A security-disabled global group was deleted

4754

A security-enabled universal group was created

4755

A security-enabled universal group was changed

4756

A member was added to a security-enabled universal group

4757

A member was removed from a security-enabled universal group

4758

A security-enabled universal group was deleted

4759

A security-disabled universal group was created

4760

A security-disabled universal group was changed

4761

A member was added to a security-disabled universal group

4762

A member was removed from a security-disabled universal group

4763

A security-disabled universal group was deleted

4764

A groups type was changed

4767

A user account was unlocked

4781

The name of an account was changed

5025

The Windows Firewall Service has been stopped

5030

The Windows Firewall Service failed to start