Windows event ID

An event ID is the number that identifies a type of event within a Windows event provider. It is the first thing analysts filter on in Windows event logs, but it is only unique per provider: the same number can mean completely different things in two different logs. Always read an event ID together with its provider and channel.

Some IDs every Windows investigator should recognise:

• Security log (Microsoft-Windows-Security-Auditing): 4624 successful logon, 4625 failed logon, 4688 process creation, 4698 scheduled task created, 1102 audit log cleared.
• System log: 7045 new service installed (Service Control Manager, see Services) and 104 log cleared.
• Microsoft-Windows-TaskScheduler/Operational: 106 task registered (see Scheduled tasks).

Three pitfalls come up constantly. First, many useful events only exist if auditing is enabled: 4688 requires process-creation auditing, and its command line needs an extra policy setting. Second, events evolve across Windows versions, adding fields, so parsers must handle several event versions. Third, the absence of an event proves little on its own — the log may have rolled over, been cleared, or never been configured.

For logon events, the event ID only tells half the story; the logon type field distinguishes a console logon from a network or RDP one. Events themselves are produced by ETW providers.