Glossary: Hardening, Firewalls and Intrusion Detection

Event ID

Also written: 4663, 4624, 4625, 4771, 4776

The number Windows gives each kind of log entry: 4663 is an access to an audited object such as a honeyfile, 4624 and 4625 are successful and failed logins, 4771 is a failed Kerberos attempt and 4776 is an NTLM credential check on a domain controller.