Windows generates a constant stream of system and application events, recorded as unique critical event ids. Monitoring these identifiers helps security teams, administrators, and developers detect intrusions, troubleshoot failures, and maintain compliance in near real time.
Each event id points to a specific action, error, or state change in the operating system or hosted services. By defining which critical event ids to monitor, organizations can reduce noise, accelerate response, and improve audit readiness across endpoints and servers.
| Event ID | Source | Severity | Typical Trigger | Recommended Action |
|---|---|---|---|---|
| 4624 | Security | Information | Successful user logon | Correlate source IP and user context for anomalies |
| 4625 | Security | Warning | Failed logon attempt | Inspect time, location, and account for brute force patterns |
| 7045 | Service Control Manager | Information | New service installation | Validate service publisher and purpose |
| 1000 | Windows Error Reporting | Error | Application crash or hang | Collect dump files and check recent updates |
| 104 | EventLog | Error | Event log service stopped | Review system stability and service health |
Monitoring Security Related Event Identifiers
Authentication Anomalies
Event ids linked to authentication, such as 4624 and 4625, should be monitored continuously. Tracking logons, logoffs, and failed attempts provides visibility into credential misuse and lateral movement attempts.
Privilege Escalation Signals
Look for events indicating token adjustments or membership changes, for example, ids tied to privilege use. Early detection of these signals helps prevent attackers from gaining higher levels of access on critical hosts.
Operational Reliability And Service Health
Service Startup And Recovery
Critical event ids tied to services, like 7035 and 7036, confirm expected start and stop actions. Pair these with crash related ids such as 1000 to correlate application failures with system behavior.
Planned Maintenance Windows
During maintenance, expect events around shutdown, restart, and configuration change. Correlating these ids with change records ensures updates complete successfully and do not introduce instability.
Configuration Drift And Compliance Monitoring
Registry And Policy Changes
Ids related to registry activity and Group Policy application, for example 4719 and 4703, highlight configuration modifications. Monitoring them supports compliance checks and helps identify unauthorized adjustments to system settings.
File Integrity And Access Attempts
Events surrounding file creation, deletion, and access, such as 4663, indicate potential resource exposure. Aligning these ids with user and process details strengthens audit trails and data protection strategies.
Forensics Readiness And Incident Investigation
Timeline Reconstruction
By mapping critical event ids to a timeline, teams can reconstruct the sequence of actions before, during, and after an incident. This approach reduces mean time to resolution and clarifies attacker behavior.
Evidence Preservation
Ensure event logs are forwarded to secure storage and retention policies are enforced. Preserving context rich event data supports legal, regulatory, and technical review processes without data loss.
Key Recommendations For Managing Critical Event Ids
- Define a baseline of normal event id patterns for each server role.
- Centralize log collection to a SIEM or monitoring platform for correlation.
- Implement tiered alerting for high severity ids like 4625 and 7045.
- Regularly review and tune thresholds to balance detection and noise.
- Document investigation playbooks for each critical event id scenario.
FAQ
Reader questions
Which critical event ids indicate a potential brute force attack on my domain controllers?
Focus on 4625 failures with multiple source IPs targeting the same account, combined with 4771 Kerberos pre authentication failures. Correlate with 4768 and 4769 ticket requests to spot coordinated attacks.
How can I differentiate legitimate remote logons from malicious ones using event ids?
Examine 4624 events for logon type 3 or 10, unusual source ports, and atypical workstations. Cross reference with 4648 logons using explicit credentials and 4672 special privileges assignment for the same session.
What event ids should I alert on for unauthorized service installations on Windows servers?
Monitor 7045 for new services and 7046 for service configuration changes via registry. Pair these with 4697 alerts indicating a service installed and started outside of approved deployment processes.
Can monitoring specific event ids help reduce the risk of ransomware encrypting shared folders?
Yes, track 5145 shares file operations and suspicious volume mount events, along with 4663 access attempts on critical files. Rapid alerts on these ids can enable early intervention before widespread encryption occurs.