Active Directory security event IDs: a DC reference

The Security log on a domain controller can record a few hundred distinct event IDs. Maybe forty of them tell you something useful about an Active Directory attack, and a much smaller number tell you what happened when read on their own. This reference lists the events that matter on DCs and AD CS servers. For each one it gives the audit subcategory that produces it, what it records, and the fields to filter on when hunting.

The auditing and detection pillar guide covers enabling Advanced Audit Policy and SACLs. This page assumes that work is done and focuses on reading the output. All subcategories live under Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies.

How to read this reference

Three rules save time:

• Where the event is logged matters. Kerberos (4768, 4769, 4771) and NTLM validation (4776) for domain accounts are logged on the DC that handled the request. Logon events (4624, 4625) are logged on the machine the user logged on to. A logon to a file server produces 4769 on a DC and 4624 on the file server.
• Nothing is logged unless the subcategory is enabled. Directory events also need a SACL on the object.
• Filter on fields, not on message text. Event messages are localized and change over time, but the XML field names (TargetUserName, TicketEncryptionType, Status) are stable.

Querying by ID and field on a DC:

# Last 50 failed Kerberos pre-authentications on this DC
Get-WinEvent -FilterHashtable @{ LogName = 'Security'; Id = 4771 } -MaxEvents 50 |
  ForEach-Object {
    $x = [xml]$_.ToXml()
    [pscustomobject]@{
      Time    = $_.TimeCreated
      Account = ($x.Event.EventData.Data | Where-Object Name -eq 'TargetUserName').'#text'
      Client  = ($x.Event.EventData.Data | Where-Object Name -eq 'IpAddress').'#text'
      Code    = ($x.Event.EventData.Data | Where-Object Name -eq 'Status').'#text'
    }
  }

Logon and session events

Subcategories: Logon/Logoff > Audit Logon, Audit Special Logon, Audit Logoff, Audit Other Logon/Logoff Events.

Logon types you will filter on: 2 interactive, 3 network, 4 batch, 5 service, 7 unlock, 8 network cleartext, 9 NewCredentials (runas /netonly, also produced by some credential-injection tools), 10 RemoteInteractive (RDP), 11 cached interactive.

Common 4625 sub-status codes:

A burst of 0xC000015B for Tier 0 accounts on workstations is often your tiering deny-logon rights working as intended, and it is worth trending.

Kerberos events

Subcategories: Account Logon > Audit Kerberos Authentication Service (4768, 4771, 4772) and Audit Kerberos Service Ticket Operations (4769, 4770, 4773).

Encryption type values: 0x11 AES128, 0x12 AES256, 0x17 RC4-HMAC, 0x18 RC4-HMAC-EXP, 0x1 / 0x3 DES (should never appear). Tracking 0x17 in 4768 and 4769 is how you measure progress toward disabling RC4. Newer builds add fields such as the account's available keys and the session key encryption type. They make that measurement much easier, so update your parsers to use them.

A failed 4769 with Status 0x1F (integrity check on decrypted field failed) can point to forged or tampered tickets. Expect false positives from clock and trust issues, so treat these as leads to investigate, not verdicts.

NTLM events

Subcategory: Account Logon > Audit Credential Validation.

For NTLM usage by protocol version and target server, enable Network security: Restrict NTLM: Audit NTLM authentication in this domain and read the Microsoft-Windows-NTLM/Operational log (8001 to 8004). That process is covered in auditing and restricting NTLM.

Account management events

Subcategories: Account Management > Audit User Account Management, Audit Computer Account Management, Audit Security Group Management.

Users

Groups

Alert in real time on 4728, 4732 and 4756 where the target is any Tier 0 group. Filter on TargetSid rather than name, so renamed or localized groups are still matched.

Computers

Directory service events

Subcategories: DS Access > Audit Directory Service Access (4662) and Audit Directory Service Changes (5136 to 5141). SACLs required.

5136 logs one event per attribute value added or removed, with OperationType %%14674 (value added) or %%14675 (value deleted). A single ACL change produces a delete event for the old descriptor and an add event for the new one. Correlate the pair on OpCorrelationID.

Useful events outside the Security log:

• Directory Service log 2889: LDAP binds without signing. See LDAP signing and channel binding.
• Directory Service log 2089: partition not backed up within the backup latency interval.
• System log 7045: new service installed on a DC.

Policy, trust and system integrity events

Treat 1102, 4719 and any 4706 as page-someone events on DCs. Legitimate occurrences are rare and should always match a change ticket.

AD CS events

Subcategory: Object Access > Audit Certification Services. The CA also needs its own audit filter, which you set on the CA server:

certutil -setreg CA\AuditFilter 127
Restart-Service certsvc

On DCs, the System log events 39, 40 and 41 (Kerberos-Key-Distribution-Center) report weak certificate mappings. They are covered in strong certificate mapping. The wider template picture is in AD CS hardening.

Pitfalls

• Volume surprises. 4624 type 3, 4634, 4769 and 4662 dominate DC log volume. Forward them anyway, but set Security log sizes large enough (several GB on busy DCs) that local logs cover at least a few days if the forwarding pipeline stalls.
• 4771 versus 4625 confusion. Kerberos failures do not produce 4625 on the DC. A spraying detection built only on 4625 misses most domain-wide attacks.
• Localized names. Group names in events are localized on non-English DCs. Match on SIDs: well-known domain RIDs (512 Domain Admins, 519 Enterprise Admins, 518 Schema Admins) and the builtin SID S-1-5-32-544 (Administrators), which has no domain prefix.
• Mixed audit policy. If legacy category settings are applied alongside Advanced Audit Policy without Audit: Force audit policy subcategory settings enabled, events silently stop.
• SACL scope creep. A SACL for Everyone reading all properties on the domain root will flood the log. Scope read auditing to decoys and write auditing to Tier 0 objects.
• Clock skew. Correlating 4768 on one DC with 4624 on a server only works if time sync is healthy across the domain.

Related reading: get these events off the DCs with Windows Event Forwarding, turn a handful of them into near-zero-false-positive alerts with honeytokens, and browse the rest of the auditing, logging and detection area.