Windows Event ID Lookup

What Windows event IDs mean: 4625, 4624, 4740, 6008, 41, 7045, 1102 and 3,000 more, with Windows' own message text, the fields and what to check.

Look up a Windows event ID from Event Viewer, a SIEM alert or a log export: what it means, the fields it records, and what to check. Many IDs are used by more than one source (event 41 is both a Kernel-Power crash and a boot error), so every definition is shown, the one people usually mean first. The message text is Windows' own, read from the event providers of Windows 10.0.26200.0, 2026-10-28; the notes are ours, based on Microsoft's security auditing reference.

Try: 4625, 4624, 4740, 6008, 41, 1074, 7045, 1102, 4104, 1149

Events people look up most

4624	Security-Auditing	An account was successfully logged on.
4625	Security-Auditing	An account failed to log on.
4634	Security-Auditing	An account was logged off.
4647	Security-Auditing	User initiated logoff:
4648	Security-Auditing	A logon was attempted using explicit credentials.
4672	Security-Auditing	Special privileges assigned to new logon.
4776	Security-Auditing	The computer attempted to validate the credentials for an account.
4740	Security-Auditing	A user account was locked out.
4767	Security-Auditing	A user account was unlocked.
4768	Security-Auditing	A Kerberos authentication ticket (TGT) was requested.
4769	Security-Auditing	A Kerberos service ticket was requested.
4771	Security-Auditing	Kerberos pre-authentication failed.
4720	Security-Auditing	A user account was created.
4722	Security-Auditing	A user account was enabled.
4723	Security-Auditing	An attempt was made to change an account's password.
4724	Security-Auditing	An attempt was made to reset an account's password.
4725	Security-Auditing	A user account was disabled.
4726	Security-Auditing	A user account was deleted.
4738	Security-Auditing	A user account was changed.
4728	Security-Auditing	A member was added to a security-enabled global group.
4729	Security-Auditing	A member was removed from a security-enabled global group.
4732	Security-Auditing	A member was added to a security-enabled local group.
4733	Security-Auditing	A member was removed from a security-enabled local group.
4756	Security-Auditing	A member was added to a security-enabled universal group.
4688	Security-Auditing	A new process has been created.
4697	Security-Auditing	A service was installed in the system.
4698	Security-Auditing	A scheduled task was created.
4719	Security-Auditing	System audit policy was changed.
1102	Eventlog	The audit log was cleared.
104	Eventlog	The … log file was cleared.
5140	Security-Auditing	A network share object was accessed.
5145	Security-Auditing	A network share object was checked to see whether client can be granted desired access.
4663	Security-Auditing	An attempt was made to access an object.
4778	Security-Auditing	A session was reconnected to a Window Station.
4779	Security-Auditing	A session was disconnected from a Window Station.
4800	Security-Auditing	The workstation was locked.
4801	Security-Auditing	The workstation was unlocked.
6005	EventLog	The Event log service was started.
6006	EventLog	The Event log service was stopped.
6008	EventLog	The previous system shutdown at … on … was unexpected.
6013	EventLog	The system uptime is … seconds.
1074	User32	The process … has initiated the … of computer … on behalf of user … for the following reason
41	Kernel-Power	The system has rebooted without cleanly shutting down first.
1001	WER-SystemErrorReporting	The computer has rebooted from a bugcheck.
7036	Service Control Manager	The … service entered the … state.
7034	Service Control Manager	The … service terminated unexpectedly.
7031	Service Control Manager	The … service terminated unexpectedly.
7000	Service Control Manager	The … service failed to start due to the following error:
7009	Service Control Manager	A timeout was reached (… milliseconds) while waiting for the … service to connect.
7038	Service Control Manager	The … service was unable to log on as … with the currently configured password due to the following error:
7040	Service Control Manager	The start type of the … service was changed from … to
7045	Service Control Manager	A service was installed in the system.
19	WindowsUpdateClient	Installation Successful: Windows successfully installed the following update
20	WindowsUpdateClient	Installation Failure: Windows failed to install the following update with error
43	WindowsUpdateClient	Installation Started: Windows has started installing the following update
44	WindowsUpdateClient	Windows Update started downloading an update.
7	disk	The device, …, has a bad block.
11	disk	The driver detected a controller error on
51	disk	An error was detected on device … during a paging operation.
153	disk	The IO operation at logical block address … for Disk … (PDO name: …) was retried.
55	Ntfs	The file system structure on the disk is corrupt and unusable.
1014	DNS-Client	Name resolution for the name … timed out after none of the configured DNS servers responded.
5719	NETLOGON	This computer was not able to set up a secure session with a domain
1129	GroupPolicy	The processing of Group Policy failed because of lack of network connectivity to a domain controller.
10016	DistributedCOM	The … permission settings do not grant … … permission for the COM Server application with CLSID
1000	Application Error	Faulting application name: …, version: …, time stamp: 0x
1002	Application Hang	The program … version … stopped interacting with Windows and was closed.
1026	.NET Runtime	.NET application ended with an unhandled exception.
1033	MsiInstaller	Windows Installer installed the product.
11707	MsiInstaller	Windows Installer: installation completed successfully.
11708	MsiInstaller	Windows Installer: installation failed.
21	TerminalServices-LocalSessionManager	Remote Desktop Services: Session logon succeeded:
22	TerminalServices-LocalSessionManager	Remote Desktop Services: Shell start notification received:
23	TerminalServices-LocalSessionManager	Remote Desktop Services: Session logoff succeeded:
24	TerminalServices-LocalSessionManager	Remote Desktop Services: Session has been disconnected:
25	TerminalServices-LocalSessionManager	Remote Desktop Services: Session reconnection succeeded:
1149	TerminalServices-RemoteConnectionManager	Remote Desktop Services: User authentication succeeded:
4104	PowerShell	Creating Scriptblock text (… of …):
1116	Windows Defender	… has detected malware or other potentially unwanted software.
1117	Windows Defender	… has detected malware or potentially unwanted software using Defender security intelligence and applied the remediation action defined in the security settings.
5001	Windows Defender	… Real-time Protection scanning for malware and other potentially unwanted software was disabled.
106	TaskScheduler	User "…" registered Task Scheduler task "…"
200	TaskScheduler	Task Scheduler launched action "…" in instance "…" of task "…".
201	TaskScheduler	Task Scheduler successfully completed task "…" , instance "…" , action "…" with return code