Decoding UAC Flags Values in events 4720, 4738, 4741, and 4742

In Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2, there are four events that contain a user account control (UAC) flags value: 4720 – user account creation 4738 – user account change 4741 – computer account creation 4742 – computer account change This value is a bitmask value, and it’s represented…

0

Auditing Changes to Audit Policy

Mitsuru, one of our support engineers in Japan, actually did some excellent research recently into exactly what our behavior is for auditing audit policy and I wanted to share that with you. In Windows, we’ve always had auditing for changes to security policy.  Audit policy has always been one aspect of that policy. However, it’s not…

10

XPath to generate a list of NTLM authentications on Windows Vista or Later

Hi Everyone, Sas sent me an email complaining that I am not posting as often as I should- sorry about that.  I am working on a different project now but I am still in close touch with the auditing team and I’ll try to do better. Anyway a question that I hear regularly is, “how…

0

Mapping pre-Vista Security Event IDs to Security Event IDs in Vista+

I’ve written twice (here and here) about the relationship between the “old” event IDs (5xx-6xx) in WS03 and earlier versions of Windows, and between the “new” security event IDs (4xxx-5xxx) in Vista and beyond. In short, EventID(WS03) + 4096 = EventID(WS08) for almost all security events in WS03. The exceptions are the logon events.  The logon…

1

Windows Server 2008 Security Events Posted

Fadi, Ned and Brian of the auditing team have documented all the auditing events by audit policy category and subcategory for your reference. Check it out in the Knowledge Base. Even better, they documented all the events in spreadsheet format, and that’s propagating to the Microsoft Download Center.  I’ll publish the link when it’s online….

0

You learn something new every day- Logon Type 0

Today I encountered something new in the logon event- I thought that was old hat and I knew all there was to know about that but I guess I was wrong. The logon event (528/540 prior to Windows Vista, 4624 in Vista and Windows Server 2008) has a field called a Logon Type.  This is…

0

I always wondered who Björn was…

OK here’s something I just remembered today.  I may be the last person who remembers this so it’s important that I record this somewhere. In the RTM bits of Windows NT 4.0, for the German language release only, someone snuck in a string resource into the auditing message file.  I’m guessing that it was one of…

1

Why does Windows XP generate so many logon failure events?

I got the question last week, why there are so many logon failure events on Windows XP when it is not domain joined. The short answer is, by design.  (Yes, bad design.) The longer answer is that the shell team is working around the fact that there is no “tell me if this user account…

2

List of Windows Server 2003 Events

So a long time ago, back in my days of providing technical support for Windows NT 4.0, I published “Security Event Descriptions”.  This article was the “schema” so to speak, for the Windows NT 4.0 security event log events. Technically Windows events are not schematized until Windows Vista; or put another way the schema is implicit based…

3

Documentation on the Windows Vista and Windows Server 2008 Security Events

I’m hearing lots of complaints that we don’t have KB articles on these yet.  Doriansoft has a blog post complaining that the “add 4096” rule doesn’t work because we collapsed the logon events into a single success event and failure event (from 2 success events [528, 540] and 10 failure events [529-537, 539]). Well, In Vista…

4