System eventlog
Print event
![]() |
10 | Document was printed on. |
![]() |
11 | Document was paused on. |
![]() |
12 | Document was resumed on. |
![]() |
13 | Document was deleted on. |
![]() |
18 | Document was timed out on. |
Security eventlog
Windows NT starting up/down
![]() |
512 | Windows NT is starting up |
![]() |
513 | Windows NT is shutting down. All logon sessions will be terminated by this shutdown. |
Logon
![]() |
529 | Logon Failure, Reason: Unknown user name or bad password. |
![]() |
530 | Logon Failure, Reason: Account logon time restriction violation. |
![]() |
531 | Logon Failure, Reason: Account currently disabled. |
![]() |
532 | Logon Failure, Reason: The specified user account has expired. |
![]() |
533 | Logon Failure, Reason: User not allowed to logon at this computer. |
![]() |
535 | Logon Failure, Reason: User not allowed to logon at this computer. |
![]() |
536 | Logon Failure, Reason: The NetLogon component is not active. |
![]() |
537 | Logon Failure, Reason: An unexpected error occurred during logon. |
![]() |
538 | User Logoff. |
Process
![]() |
560 | Object Open. |
![]() |
562 | Handle Closed. |
![]() |
576 | Special privileges assigned to new logon |
![]() |
592 | A new process has been created. |
![]() |
539 | A process has exited. |
![]() |
594 | A handle to an object has been duplicated. |