Menu
What is the event id in Event Viewer for lock, unlock for a computer in Windows XP, Windows 7, Windows Vista and Windows Server 2008?
993
Event 4738 is generated every time a user object is changed. At times, this event may not show any changes—that is, all Changed Attributes appear as “-. “ This usually happens when a change is made to an attribute that is not listed in the event. In this case, there's no way to determine which attribute was changed.
Event ID - 16384The account Name could not be upgraded since there is an account with an equivalent name. Event Information. According to Microsoft: CAUSE: This issue occurs because several user, computer, and trust relationship names that are used in earlier versions of Windows are restricted in Windows 2000.
Event 1102 is logged whenever the Security log is cleared, REGARDLESS of the status of the Audit System Events audit policy. The Account Name and Domain Name fields identify the user who cleared the log.
Event 531 is logged on a domain controller only when a user fails to log on to the domain controller itself (such as at the console or through failure to connect to a shared folder). On workstations and servers, this event can be generated by an attempt to log on with a domain or local SAM account.
The lock event ID is 4800, and the unlock is 4801. You can find them in the Security logs. You probably have to activate their auditing using Local Security Policy (secpol.msc, Local Security Settings in Windows XP) -> Local Policies -> Audit Policy. For Windows 10 see the picture below.
Look in Description of security events in Windows 7 and in Windows Server 2008 R2 under Subcategory: Other Logon/Logoff Events.
123
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
