Active Directory (AD) Event ID Reference Guide
Account and Authentication Events
Event ID 4624: Successful logon
Event ID 4625: Failed logon
Event ID 4647: User initiated logoff
Event ID 4648: Logon with explicit credentials
Event ID 4675: SIDs were filtered
User Account Changes
Event ID 4720: User account created
Event ID 4722: User account enabled
Event ID 4723: Attempt to change password
Event ID 4724: Attempt to reset password
Event ID 4725: User account disabled
Event ID 4726: User account deleted
Event ID 4738: User account changed
Event ID 4740: Account locked out
Event ID 4767: Account unlocked
Group Membership & Permission Changes
Active Directory (AD) Event ID Reference Guide
Event ID 4727: Security-enabled global group created
Event ID 4728: Member added to security-enabled global group
Event ID 4729: Member removed from security-enabled global group
Event ID 4730: Security-enabled global group deleted
Event ID 4731: Security-enabled local group created
Event ID 4732: Member added to security-enabled local group
Event ID 4733: Member removed from security-enabled local group
Event ID 4734: Security-enabled local group deleted
Event ID 4735: Security-enabled local group changed
Event ID 4756: Member added to a universal group
Event ID 4757: Member removed from a universal group
Event ID 4758: Universal group deleted
Event ID 4759: Universal group changed
Privilege Use and Escalation
Event ID 4670: Permissions on an object were changed
Event ID 4672: Special privileges assigned to new logon
Event ID 4673: A privileged service was called
Active Directory (AD) Event ID Reference Guide
Event ID 4674: An operation was attempted on a privileged object
Kerberos & Ticket Activity
Event ID 4768: TGT was requested
Event ID 4769: TGS was requested
Event ID 4770: TGT was renewed
Event ID 4771: Kerberos pre-authentication failed
Event ID 4776: NTLM authentication attempt
Event ID 4778: Remote desktop session reconnected
Event ID 4779: Remote desktop session disconnected
Changes to Security Settings / Audit Policy
Event ID 4719: System audit policy was changed
Event ID 4902: The Per-user audit policy table was created
Event ID 4907: Auditing settings on an object were changed
Group Policy & Directory Service Changes
Event ID 4739: Domain policy was changed
Event ID 4737: Domain local group changed
Event ID 5132: Security descriptor was changed
Active Directory (AD) Event ID Reference Guide
Event ID 5136: Directory object modified
Event ID 5137: Directory object created
Event ID 5138: Directory object undeleted
Event ID 5139: Directory object moved
Event ID 5141: Directory object deleted
Service and Task Creation
Event ID 4697: A service was installed in the system
Event ID 4698: A scheduled task was created
Event ID 4702: A scheduled task was updated
Lateral Movement & Remote Commands
Event ID 7045: New service was installed (from Sysmon/System logs)
Event ID 5140: A network share was accessed
Event ID 5145: Detailed file share access