Interpreting Security Log Events

Security and audit-related events can often be challenging to interpret.  Here are two resources that can help:

  • See KB947226 "Description of security events in Windows Vista and in Windows Server 2008" found at
  • You can also run the command wevtutil gp Microsoft-Windows-Security-Auditing /ge /gm:true to get a detailed listing of all security event IDs.

Mitch Tulloch is a seven-time recipient of the Microsoft Most Valuable Professional (MVP) award and widely recognized expert on Windows administration, deployment and virtualization. For more tips by Mitch you can follow him on Twitter or friend him on Facebook.

About The Author

Leave a Comment

Your email address will not be published. Required fields are marked *

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Scroll to Top