System eventlog
Print event
10 | Document was printed on. | |
11 | Document was paused on. | |
12 | Document was resumed on. | |
13 | Document was deleted on. | |
18 | Document was timed out on. |
Security eventlog
Windows NT starting up/down
512 | Windows NT is starting up | |
513 | Windows NT is shutting down. All logon sessions will be terminated by this shutdown. |
Logon
529 | Logon Failure, Reason: Unknown user name or bad password. | |
530 | Logon Failure, Reason: Account logon time restriction violation. | |
531 | Logon Failure, Reason: Account currently disabled. | |
532 | Logon Failure, Reason: The specified user account has expired. | |
533 | Logon Failure, Reason: User not allowed to logon at this computer. | |
535 | Logon Failure, Reason: User not allowed to logon at this computer. | |
536 | Logon Failure, Reason: The NetLogon component is not active. | |
537 | Logon Failure, Reason: An unexpected error occurred during logon. | |
538 | User Logoff. |
Process
560 | Object Open. | |
562 | Handle Closed. | |
576 | Special privileges assigned to new logon | |
592 | A new process has been created. | |
539 | A process has exited. | |
594 | A handle to an object has been duplicated. |