# Windows Logs

### Account Management Logs

| Event ID     | Explanation                                  |
| ------------ | -------------------------------------------- |
| Event ID 624 | User Account Created                         |
| Event ID 626 | User Account enabled                         |
| Event ID 627 | password change attempted                    |
| Event ID 628 | user account password set                    |
| Event ID 629 | user account disabled                        |
| Event ID 630 | user account deleted                         |
| Event ID 631 | security enabled global group created        |
| Event ID 632 | security enabled global group member added   |
| Event ID 633 | security enabled global group member removed |
| Event ID 634 | security enabled global group deleted        |
| Event ID 635 | security enabled local group created         |
| Event ID 636 | security enabled local group member added    |
| Event ID 637 | security enabled local group member removed  |
| Event ID 638 | security enabled local group deleted         |
| Event ID 639 | security enabled local group changed         |
| Event ID 641 | security enabled global group changed        |
| Event ID 642 | user account changed                         |
| Event ID 643 | domain policy changed                        |

### System Events

| Event ID     | Explanation                                                                                                            |
| ------------ | ---------------------------------------------------------------------------------------------------------------------- |
| Event ID 512 | Windows is starting up                                                                                                 |
| Event ID 513 | windows is shutting down                                                                                               |
| Event ID 516 | internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits |
| Event ID 517 | the security log was cleared                                                                                           |

### Policy Changes

| Event ID      | Explanation                                                                                                  |
| ------------- | ------------------------------------------------------------------------------------------------------------ |
| Event ID 608  | A user right was assigned                                                                                    |
| Event ID 609  | a user right was removed                                                                                     |
| Event ID 610  | a trust relationship with another domain was created                                                         |
| Event ID 611  | a trust relationship with another domain was removed                                                         |
| Event ID 612  | an audit policy was changed                                                                                  |
| Event ID 4864 | a collision was detected between a namespace element in one forest and a namespace element in another forest |

### Query for Windows Event Logs 

```
wevtutil qe Security /c:100 /rd:true /q:"*[System[(EventID=612)]]"

Security --> Log name you want to query
/c: --> count returned
/rd: --> reverse direction true|false
/q: --> your query
```