Home » KBArticles » Security Logs Windows 2008 R2

Security Logs Windows 2008 R2

4740 – Account lockout, (giving user and the workstation thats actually locking out the account.)

5136 – Group policy links added or deleted

2013 – disk space at or near exhaustion

 

4727 – A security-enabled global group was created.

4728 – A member was added to a security-enabled global group.

4730 – A security-enabled global group was deleted.

4731 – A security-enabled local group was created.

4732 – A member was added to a security-enabled local group.

4733 – A member was removed from a security-enabled local group.

4734 – A security-enabled local group was deleted.

4735 – A security-enabled local group was changed.

4737 – A security-enabled global group was changed.

4754 – A security-enabled universal group was created.

4755 – A security-enabled universal group was changed.

4756 – A member was added to a security-enabled universal group.

4757 – A member was removed from a security-enabled universal group.

4758 – A security-enabled universal group was deleted.

You can trawl for these events using the microsoft provided EventCombMT.exe – however the security log option will be GREYED out unless you run as administrator.

More details below..

http://support.microsoft.com/kb/947226

Leave a Reply

Your email address will not be published.

This site uses Akismet to reduce spam. Learn how your comment data is processed.