ABCDEFGHIJKLMNOPQRSTUVWXYZ
1
Operation / TypeStringValue
2
Impersonation Level%%1832Identification
3
Impersonation Level%%1833Impersonation
4
Impersonation Level%%1840Delegation
5
Impersonation Level%%1841Denied by Process Trust Label ACE
6
Impersonation Level%%1842Yes
7
Impersonation Level%%1843No
8
Impersonation Level%%1844System
9
Impersonation Level%%1845Not Available
10
Impersonation Level%%1846Default
11
Impersonation Level%%1847DisallowMmConfig
12
Impersonation Level%%1848Off
13
Impersonation Level%%1849Auto
14
Impersonation Level-Anonymous
15
Boolean Check%%1842Yes
16
Boolean Check%%1843No
17
Event Status0xc000005eThere are currently no logon servers available to service the logon request
18
Event Status0xc0000064User logon with misspelled or bad user account
19
Event Status0xc000006aUser logon with misspelled or bad password
20
Event Status0xc000006dThis is either due to a bad username or authentication information
21
Event Status0xc000006eUnknown user name or bad password
22
Event Status0xc000006fUser logon outside authorized hours
23
Event Status0xc0000070User logon from unauthorized workstation
24
Event Status0xc0000071User logon with expired password
25
Event Status0xc0000072User logon to account disabled by administrator
26
Event Status0xc00000dc
Indicates the Sam Server was in the wrong state to perform the desired operation
27
Event Status0xc0000133Clocks between DC and other computer too far out of sync
28
Event Status0xc000015b
The user has not been granted the requested logon type (aka logon right) at this machine
29
Event Status0xc000018c
The logon request failed because the trust relationship between the primary domain and the trusted domain failed
30
Event Status0xc0000192An attempt was made to logon, but the Netlogon service was not started
31
Event Status0xc0000193User logon with expired account
32
Event Status0xc0000224User is required to change password at next logon
33
Event Status0xc0000225Evidently a bug in Windows and not a risk
34
Event Status0xc0000234User logon with account locked
35
Event Status0xc00002eeFailure Reason: An Error occurred during Logon
36
Event Status0xc0000413
Logon Failure: The machine you are logging onto is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine
37
AD Object Type0x0Status OK
38
AD Object Typef30e3bc2-9ff0-11d1-b603-0000f80367c1Group-Policy-Container
39
AD Object Type
19195a5b-6da0-11d0-afd3-00c04fd930c9
Domain-DNS
40
AD Object Type
bf967aa5-0de6-11d0-a285-00aa003049e2
Organizational-Unit
41
AD Object Type
bf967a8b-0de6-11d0-a285-00aa003049e2
Container
42
AD Object Type
bf967a86-0de6-11d0-a285-00aa003049e2
Computer
43
AD Object Type
2628a46a-a6ad-4ae0-b854-2b12d9fe6f9e
Account
44
AD Object Type
bf967a9c-0de6-11d0-a285-00aa003049e2
Group
45
Token Elevation Type%%1936TokenElevationTypeDefault
46
Token Elevation Type%%1937TokenElevationTypeFull
47
Token Elevation Type%%1938TokenElevationTypeLimited
48
Process RID levelS-1-16-0SECURITY_MANDATORY_UNTRUSTED_RID
49
Process RID levelS-1-16-4096SECURITY_MANDATORY_LOW_RID
50
Process RID levelS-1-16-8192SECURITY_MANDATORY_MEDIUM_RID
51
Process RID levelS-1-16-8448SECURITY_MANDATORY_MEDIUM_PLUS_RID
52
Process RID levelS-1-16-12288SECURITY_MANDATORY_HIGH_RID
53
Process RID levelS-1-16-16384SECURITY_MANDATORY_SYSTEM_RID
54
Process RID levelS-1-16-20480SECURITY_MANDATORY_PROTECTED_PROCESS_RID
55
Key Type%%2500User key
56
Key Operation%%2480Open key
57
Network Layer Name%%14608Resource Assignment
58
Network Layer Name%%14609Listen
59
Network Layer Name%%14610Receive/Accept
60
Network Layer Name%%14611Connect
61
Network Direction%%14592Inbound
62
Network Direction%%14593Outbound
63
Object Access Requested%%1537DELETE
64
Ticket Encryption Type0x1DES-CBC-CRC
65
Ticket Encryption Type0x3DES-CBC-MD5
66
Ticket Encryption Type0x11AES128-CTS-HMAC-SHA1-96
67
Ticket Encryption Type0x12AES256-CTS-HMAC-SHA1-96
68
Ticket Encryption Type0x17RC4-HMAC
69
Ticket Encryption Type0x18RC4-HMAC-EXP
70
Ticket Encryption Type0xFFFFFFFFFailure Event
71
Ticket Encryption Type0xffffffffFailure Event
72
Ticket Options0x40810010Forwardable, Renewable, Canonicalize, Renewable-ok
73
Ticket Options0x40810000Forwardable, Renewable, Canonicalize
74
Ticket Options0x60810010Forwardable, Forwarded, Renewable, Canonicalize, Renewable-ok
75
Ticket Options0x40800000Forwardable, Renewable
76
Ticket Options0x10002Proxiable, Unused
77
Service Ticket Pre-Auth Type0Without Pre-Authentication
78
Service Ticket Pre-Auth Type2PA-ENC-TIMESTAMP
79
Service Ticket Pre-Auth Type11PA-ETYPE-INFO
80
Service Ticket Pre-Auth Type15PA-PK-AS-REP_OLD
81
Service Ticket Pre-Auth Type17PA-PK-AS-REP
82
Service Ticket Pre-Auth Type19PA-ETYPE-INFO2
83
Service Ticket Pre-Auth Type20PA-SVR-REFERRAL-INFO
84
Service Ticket Pre-Auth Type138PA-ENCRYPTED-CHALLENGE
85
Service Ticket Pre-Auth Type-Failure Event
86
Ticket Failure Code0x10KDC_ERR_PADATA_TYPE_NOSUPP
87
Ticket Failure Code0x17KDC_ERR_KEY_EXPIRED
88
Ticket Failure Code0x18KDC_ERR_PREAUTH_FAILED
89
Key Operation%%2480Open Key
90
Key Operation%%2458Read persisted key from file
91
Key Operation%%2464Export of persistent cryptographic key
92
DS Object Domain Type%%14676Active Directory Domain Services
93
Object Operation Type%%8100Enumerate Credentials
94
95
96
97
98
99
100