Glossary: Logs and Data Sources for Investigations

Windows Security event IDs

Also written: event 4624, event 4625, event 4740, event 4768, event 4771, event 4776, event 1102

Numbers for Windows Security log events: 4624 successful sign-in, 4625 failed sign-in, 4740 account lockout, 4768 and 4771 Kerberos credential checks, 4776 NTLM credential check, and 1102 audit log cleared (a sign an attacker may be hiding). Sign-in events are written on the computer signed in to; credential checks and lockouts are recorded on the domain controller.