Event Log > Security
User Account
| Event ID | Description |
| 4720 | Created |
| 4722 | Enabled |
| 4723 | User Changed own password |
| 4724 | Someone changed this user’s password |
| 4725 | Disabled |
| 4726 | Deleted |
| 4738 | Changed |
| 4740 | Locked Out |
| 4767 | Unlocked |
| 4781 | Name Change |
Logon Failure
| Code | Description |
| 0xC0000064 | Username doesn’t exist |
| 0xC000006A | Username OK, password wrong |
| 0xC0000234 | User locked out |
| 0xC0000072 | User disabled |
| 0xC000006F | Day Time restriction |
| 0xC0000070 | Workstation restriction |
| 0xC0000193 | Account Expired |
| 0xC0000171 | Password Expired |
| 0xC0000133 | Time Sync issue (client <==> DC) |
| 0xC0000224 | Password change at next logon checked |
| 0xC000015B | Logon not granted |