DetailPage-MSS-KB

Microsoft small business knowledge base

Article ID: 301677 - Last Review: June 19, 2014 - Revision: 4.0

Notice
This article applies to Windows 2000. Support for Windows 2000 ends on July 13, 2010. The Windows 2000 End-of-Support Solution Center (http://support.microsoft.com/win2000) is a starting point for planning your migration strategy from Windows 2000. For more information see the Microsoft Support Lifecycle Policy (http://support.microsoft.com/lifecycle/) .

Summary

This article contains descriptions of various security-related and auditing-related events, and information about how to interpret these events. These events will all appear in the Security event log and will be logged with a source of "Security." The following article in the Microsoft Knowledge Base is Part 1 of 2:
299475  (http://support.microsoft.com/kb/299475/EN-US/ ) Windows 2000 Security Event Descriptions (Part 1 of 2)

More information

   Event ID: 608 (0x0260)
       Type: Success Audit
Description: User Right Assigned
             User Right: %1             Assigned To: %2
Assigned By  User Name: %3              Domain: %4
             Logon ID: %5
				
   Event ID: 609 (0x0261)
       Type: Success Audit
Description: User Right Removed
             User Right: %1             Removed From: %2
Removed By:  User Name: %3              Domain: %4
             Logon ID: %5
				
   Event ID: 610 (0x0262)
       Type: Success Audit
Description: New Trusted Domain         
             Domain Name: %1            Domain ID: %2
Established By:  
             User Name: %3              Domain: %4
             Logon ID: %5
				
   Event ID: 611 (0x0263)
       Type: Success Audit
Description: Removing Trusted Domain
             Domain Name: %1            Domain ID: %2
Removed By:  User Name: %3              Domain: %4
             Logon ID: %5
				
   Event ID: 612 (0x0264)
       Type: Success Audit
Description: Audit Policy Change
             New Policy:
             Success   Failure
               %1         %2    System
               %3         %4    Logon/Logoff
               %5         %6    Object Access
               %7         %8    Privilege Use
               %9        %10    Detailed Tracking
              %11        %12    Policy Change
              %13        %14    Account Management
             Changed By:
             User Name: %15             Domain Name: %16
             Logon ID: %17
				
   Event ID: 613 (0x0265)
       Type: Success Audit
Description: IPSec policy agent started  
             Ipsec Policy Agent: %1     Policy Source:  %2
             Event Data: %3
				
   Event ID: 614 (0x0266)
       Type: Success Audit
Description: IPSec policy agent disabled
             Ipsec Policy Agent: %1     Event Data:  %2
				
   Event ID: 615 (0x0267)
       Type: Success Audit
Description: IPSEC PolicyAgent Service:  %1
             Event Data: %1
				
   Event ID: 616 (0x0268)
       Type: Failure Audit
Description: IPSec policy agent encountered a potentially serious failure.
             Event Data: %1
				
   Event ID: 617 (0x0269)
       Type: Success Audit
Description: Kerberos Policy Changed
Changed By:  User Name: %1              Domain Name: %2
             Logon ID: %3               
Changes made: %4
'-'  means no changes, otherwise each change is shown as:
Parameter Name: (new value) (old value)
				
   Event ID: 618 (0x026a)
       Type: Success Audit
Description: Encrypted Data Recovery Policy Changed
Changed By:  User Name: %1              Domain Name: %2
             Logon ID: %3               
Changes made: %4
'-'  means no changes, otherwise each change is shown as:
Parameter Name: new value (old value)
				
   Event ID: 619 (0x026b)
       Type: Success Audit
Description: Quality of Service Policy Changed
Changed By:  User Name: %1              Domain Name: %2
             Logon ID: %3               
Changes made: %4
'-'  means no changes, otherwise each change is shown as:
Parameter Name: new value (old value)
				
   Event ID: 620 (0x026C)
Description: Trusted Domain Information Modified:
             Domain Name: %1            Domain ID: %2
Modified By: User Name: %3              Domain: %4
             Logon ID: %5
				
   Event ID: 624 (0x0270)
       Type: Success Audit
Description: User Account Created
             New Account Name: %1       New Domain: %2
             New Account ID: %3
             Caller User Name: %4       Caller Domain: %5
             Caller Logon ID: %6        Privileges %7
				
   Event ID: 625 (0x0271)
Description: User Account Type Change
       Type: Success Audit
             Target Account Name: %1    Target Domain: %2
             Target Account ID: %3
             New Type: %4               Caller User Name: %5
             Caller Domain: %6          Caller Logon ID: %7
				
   Event ID: 626 (0x0272)
Description: User Account Enabled
       Type: Success Audit
             Target Account Name: %1    Target Domain: %2
             Target Account ID: %3
             Caller User Name: %4       Caller Domain: %5
             Caller Logon ID: %6
				Note Windows 2000 does not log event ID 626 explicitly. Results are logged as a part of event ID 642 in the description of the message. 
   Event ID: 627 (0x0273)
       Type: Success Audit
Description: Change Password Attempt
             Target Account Name: %1    Target Domain: %2
             Target Account ID: %3
             Caller User Name: %4       Caller Domain: %5
             Caller Logon ID: %6        Privileges: %7
				
   Event ID: 628 (0x0274)
       Type: Success Audit
Description: User Account password set
             Target Account Name: %1    Target Domain: %2
             Target Account ID: %3
             Caller User Name: %4       Caller Domain: %5
             Caller Logon ID: %6
				
   Event ID: 630 (0x0276)
       Type: Success Audit
Description: User Account Deleted:
             Target Account Name: %1    Target Domain: %2
             Target Account ID: %3
             Caller User Name: %4       Caller Domain: %5
             Caller Logon ID: %6        Privileges: %7
				
   Event ID: 631 (0x0277)
       Type: Success Audit
Description: Security Enabled Global Group Created
             New Account Name: %1       New Domain: %2
             New Account ID: %3
             Caller User Name: %4       Caller Domain: %5
             Caller Logon ID: %6        Privileges: %7
				
   Event ID: 632 (0x0278)
       Type: Success Audit
Description: Security Enabled Global Group Member Added
             Member Name: %1            Member ID: %2
             Target Account Name: %3    Target Domain: %4
             Target Account ID: %5
             Caller User Name: %6       Caller Domain: %7
             Caller Logon ID: %8        Privileges: %9
				
   Event ID: 633 (0x0279)
       Type: Success Audit
Description: Security Enabled Global Group Member Removed
             Member Name: %1            Member ID: %2
             Target Account Name: %3    Target Domain: %4
             Target Account ID: %5
             Caller User Name: %6       Caller Domain: %7
             Caller Logon ID: %8        Privileges: %9
				
   Event ID: 634 (0x027A)
       Type: Success Audit
Description: Security Enabled Global Group Deleted
             Target Account Name: %1    Target Domain: %2
             Target Account ID: %3
             Caller User Name: %4       Caller Domain: %5
             Caller Logon ID: %6        Privileges: %7
				
   Event ID: 635 (0x027B)
       Type: Success Audit
Description: Security Enabled Local Group Created
             New Account Name: %1       New Domain: %2
             New Account ID: %3
             Caller User Name: %4       Caller Domain: %5
             Caller Logon ID: %6        Privileges: %7
				
   Event ID: 636 (0x027C)
       Type: Success Audit

Description: Security Enabled Local Group Member Added
             Member Name: %1            Member ID: %2
             Target Account Name: %3    Target Domain: %4
             Target Account ID: %5
             Caller User Name: %6       Caller Domain: %7
             Caller Logon ID: %8        Privileges: %9
				
   Event ID: 637 (0x027D)
       Type: Success Audit
Description: Security Enabled Local Group Member Removed
             Member Name: %1            Member ID: %2
             Target Account Name: %3    Target Domain: %4
             Target Account ID: %5
             Caller User Name: %6       Caller Domain: %7
             Caller Logon ID: %8        Privileges: %9
				
   Event ID: 638 (0x027E)
       Type: Success Audit
Description: Security Enabled Local Group Deleted
             Target Account Name: %1    Target Domain: %2
             Target Account ID: %3
             Caller User Name: %4       Caller Domain: %5
             Caller Logon ID: %6        Privileges: %7
				
   Event ID: 639 (0x027F)
       Type: Success Audit
Description: Security Enabled Local Group Changed
             Target Account Name: %1    Target Domain: %2
             Target Account ID: %3
             Caller User Name: %4       Caller Domain: %5
             Caller Logon ID: %6        Privileges: %7
				
   Event ID: 640 (0x0280)
       Type: Success Audit
Description: General Account Database Change
             Type of change: %1         Object Type: %2
             Object Name: %3            Object ID: %4
             Caller User Name: %5       Caller Domain: %6
             Caller Logon ID: %7
				
   Event ID: 641 (0x0281)
       Type: Success Audit
Description: Security Enabled Global Group Changed
             Target Account Name: %1    Target Domain: %2
             Target Account ID: %3
             Caller User Name: %4       Caller Domain: %5
             Caller Logon ID: %6        Privileges: %7
				
   Event ID: 642 (0x0282)
       Type: Success Audit
Description: User Account Changed
             Target Account Name: %1    Target Domain: %2
             Target Account ID: %3
             Caller User Name: %4       Caller Domain: %5
             Caller Logon ID: %6        Privileges: %7
				
   Event ID: 643 (0x0283)
       Type: Success Audit
Description: Domain Policy Changed: %1 modified
             Domain: %2                 Domain ID: %3
             Caller User Name: %4       Caller Domain: %5
             Caller Logon ID: %6        Privileges: %7
				
   Event ID: 644 (0x0284)
       Type: Success Audit
Description: User Account Locked Out
             Target Account Name: %1    Target Account ID: %3
             Caller Machine Name: %2
             Caller User Name: %4       Caller Domain: %5
             Caller Logon ID: %6
				
   Event ID: 645 (0x0285)
       Type: Success Audit
Description: Computer Account Created
             New Account Name: %1       New Domain: %2
             New Account ID: %3
             Caller User Name: %4       Caller Domain: %5
             Caller Logon ID: %6        Privileges %7
				
   Event ID: 646 (0x0286)
       Type: Success Audit
Description: Computer Account Changed
             Target Account Name: %1    Target Domain: %2
             Target Account ID: %3
             Caller User Name: %5       Caller Domain: %6
             Caller Logon ID: %7        Privileges: %8
				
   Event ID: 647 (0x0287)
       Type: Success Audit
Description: Computer Account Deleted
             Target Account Name: %1    Target Domain: %2
             Target Account ID: %3
             Caller User Name: %4       Caller Domain: %5
             Caller Logon ID: %6        Privileges: %7
				
   Event ID: 648 (0x0288)
       Type: Success Audit
Description: Security Disabled Local Group Created
             Target Account Name: %1    Target Domain: %2
             Target Account ID: %3
             Caller User Name: %4       Caller Domain: %5

             Caller Logon ID: %6        Privileges: %7
				
   Event ID: 649 (0x0289)
       Type: Success Audit
Description: Security Disabled Local Group Changed
             Target Account Name: %1    Target Domain: %2
             Target Account ID: %3
             Caller User Name: %4       Caller Domain: %5
             Caller Logon ID: %6        Privileges: %7
				
   Event ID: 650 (0x028A)
       Type: Success Audit
Description: Security Disabled Local Group Member Added
             Member Name: %1            Member ID: %2
             Target Account Name: %3    Target Domain: %4
             Target Account ID: %5
             Caller User Name: %6       Caller Domain: %7
             Caller Logon ID: %8        Privileges: %9
				
   Event ID: 651 (0x028B)
       Type: Success Audit
Description: Security Disabled Local Group Member Removed
             Member Name: %1            Member ID: %2
             Target Account Name: %3    Target Domain: %4
             Target Account ID: %5
             Caller User Name: %6       Caller Domain: %7
             Caller Logon ID: %8        Privileges: %9
				
   Event ID: 652 (0x028C)
       Type: Success Audit
Description: Security Disabled Local Group Deleted
             Target Account Name: %1    Target Domain: %2
             Target Account ID: %3
             Caller User Name: %4       Caller Domain: %5
             Caller Logon ID: %6        Privileges: %7
				
   Event ID: 653 (0x028D)
       Type: Success Audit
Description: Security Disabled Global Group Created
             New Account Name: %1       New Domain: %2
             New Account ID: %3
             Caller User Name: %4       Caller Domain: %5
             Caller Logon ID: %6        Privileges: %7
				
   Event ID: 654 (0x028E)
       Type: Success Audit
Description: Security Disabled Global Group Changed
             Target Account Name: %1    Target Domain: %2
             Target Account ID: %3
             Caller User Name: %4       Caller Domain: %5
             Caller Logon ID: %6        Privileges: %7
				
   Event ID: 655 (0x028F)
       Type: Success Audit
Description: Security Disabled Global Group Member Added
             Member Name: %1            Member ID: %2
             Target Account Name: %3    Target Domain: %4
             Target Account ID: %5
             Caller User Name: %6       Caller Domain: %7
             Caller Logon ID: %8        Privileges: %9
				
   Event ID: 656 (0x0290)
       Type: Success Audit
Description: Security Disabled Global Group Member Removed
             Member Name: %1            Member ID: %2
             Target Account Name: %3    Target Domain: %4
             Target Account ID: %5
             Caller User Name: %6       Caller Domain: %7
             Caller Logon ID: %8        Privileges: %9
				
   Event ID: 657 (0x0291)
       Type: Success Audit
Description: Security Disabled Global Group Deleted
             Target Account Name: %1    Target Domain: %2
             Target Account ID: %3
             Caller User Name: %4       Caller Domain: %5
             Caller Logon ID: %6        Privileges: %7
				
   Event ID: 658 (0x0292)
       Type: Success Audit
Description: Security Enabled Universal Group Created
             New Account Name: %1       New Domain: %2
             New Account ID: %3
             Caller User Name: %4       Caller Domain: %5
             Caller Logon ID: %6        Privileges: %7
				
   Event ID: 659 (0x0293)
       Type: Success Audit
Description: Security Enabled Universal Group Changed
             Target Account Name: %1    Target Domain: %2
             Target Account ID: %3
             Caller User Name: %4       Caller Domain: %5
             Caller Logon ID: %6        Privileges: %7
				
   Event ID: 660 (0x0294)
       Type: Success Audit
Description: Security Enabled Universal Group Member Added
             Member Name: %1            Member ID: %2
             Target Account Name: %3    Target Domain: %4
             Target Account ID: %5
             Caller User Name: %6       Caller Domain: %7
             Caller Logon ID: %8        Privileges: %9
				
   Event ID: 661 (0x0295)
       Type: Success Audit
Description: Security Enabled Universal Group Member Removed
             Member Name: %1            Member ID: %2
             Target Account Name: %3    Target Domain: %4
             Target Account ID: %5
             Caller User Name: %6       Caller Domain: %7
             Caller Logon ID: %8        Privileges: %9
				
   Event ID: 662 (0x0296)
       Type: Success Audit
Description: Security Enabled Universal Group Deleted
             Target Account Name: %1    Target Domain: %2
             Target Account ID: %3
             Caller User Name: %4       Caller Domain: %5
             Caller Logon ID: %6        Privileges: %7
				
   Event ID: 663 (0x0297)
       Type: Success Audit
Description: Security Disabled Universal Group Created
             New Account Name: %1       New Domain: %2
             New Account ID: %3
             Caller User Name: %4       Caller Domain: %5
             Caller Logon ID: %6        Privileges: %7
				
   Event ID: 664 (0x0298)
       Type: Success Audit
Description: Security Disabled Universal Group Changed
             Target Account Name: %1    Target Domain: %2
             Target Account ID: %3
             Caller User Name: %4       Caller Domain: %5
             Caller Logon ID: %6        Privileges: %7
				
   Event ID: 665 (0x0299)
       Type: Success Audit
Description: Security Disabled Universal Group Member Added
             Member Name: %1            Member ID: %2
             Target Account Name: %3    Target Domain: %4
             Target Account ID: %5
             Caller User Name: %6       Caller Domain: %7
             Caller Logon ID: %8        Privileges: %9
				
   Event ID: 666 (0x029A)
       Type: Success Audit
Description: Security Disabled Universal Group Member Removed
             Member Name: %1            Member ID: %2
             Target Account Name: %3    Target Domain: %4
             Target Account ID: %5
             Caller User Name: %6       Caller Domain: %7
             Caller Logon ID: %8        Privileges: %9
				
   Event ID: 667 (0x029B)
       Type: Success Audit
Description: Security Disabled Universal Group Deleted
             Target Account Name: %1    Target Domain: %2
             Target Account ID: %3
             Caller User Name: %4       Caller Domain: %5
             Caller Logon ID: %6        Privileges: %7
				
   Event ID: 668 (0x029C)
       Type: Success Audit
Description: Group Type Changed
             Target Account Name: %1    Target Domain: %2
             Target Account ID: %3
             Caller User Name: %5       Caller Domain: %6
             Caller Logon ID: %7        Privileges: %8
				
   Event ID: 669 (0x029D)
       Type: Success Audit
Description: Add SID History
             Source Account Name: %1    Source Account ID: %2
             Target Account Name: %3    Target Domain: %4
             Target Account ID: %5
             Caller User Name: %6       Caller Domain: %7
             Caller Logon ID: %8        Privileges: %9
				
   Event ID: 670 (0x029E)
       Type: Success Audit
Description: Add SID History
             Source Account Name: %1    Target Account Name: %2
             Target Domain: %3          Target Account ID: %4
             Caller User Name: %5       Caller Domain: %6
             Caller Logon ID: %7        Privileges: %8
				
   Event ID: 672 (0x02a0)
       Type: Success Audit
Description: Authentication Ticket Granted
             User Name: %1              Supplied Realm Name: %2
             User ID: %3                Service Name: %4
             Service ID: %5             Ticket Options: %6
             Ticket Encryption Type: %7 Pre-Authentication Type: %8
             Client Address: %9
				
   Event ID: 673 (0x02a1)
       Type: Success Audit
Description: Service Ticket Granted
             User Name: %1              User Domain: %2
             Service Name: %3           Service ID: %4
             Ticket Options: %5         Ticket Encryption Type: %6
             Client Address: %7
				
   Event ID: 674 (0x02a2)
       Type: Success Audit
Description: Ticket Granted Renewed
             User Name: %1              User Domain: %2
             Service Name: %3           Service ID: %4
             Ticket Options: %5         Ticket Encryption Type: %6
             Client Address: %7
				
   Event ID: 675 (0x02a3)
       Type: Failure Audit
Description: Pre-authentication failed
             User Name: %1              User ID: %2
             Service Name: %3           Pre-Authentication Type: %4
             Failure Code: %5           Client Address: %6
				
   Event ID: 676 (0x02a4)
       Type: Failure Audit
Description: Authentication Ticket Request Failed
             User Name: %1              Supplied Realm Name: %2
             Service Name: %3           Ticket Options: %4
             Failure Code: %5           Client Address: %6
				
   Event ID: 677 (0x02a5)
       Type: Failure Audit
Description: Service Ticket Request Failed:
Description: Authentication Ticket Request Failed
             User Name: %1              Supplied Realm Name: %2
             Service Name: %3           Ticket Options: %4
             Failure Code: %5           Client Address: %6
				
   Event ID: 678 (0x02a6)
       Type: Success Audit
Description: Account Mapped for Logon by: %1
             Client Name: %2            Mapped Name:%3
				
   Event ID: 679 (0x02a7)
       Type: Failure Audit
Description: The name: %2 could not be mapped for logon by: %1
				
   Event ID: 680 (0x02a8)
       Type: Success Audit
Description: Account Used for Logon by: %1
             Account Name: %2           Workstation: %3
				
   Event ID: 681 (0x02a9)
       Type: Failure Audit
Description: The logon to account: %2 by: %1 from workstation: %3 failed. The error code was: %4
				
   Event ID: 682 (0x02aa)
       Type: Success Audit
Description: Session reconnected to winstation:
             User Name: %1              Domain: %2
             Logon ID: %3               Session Name: %4
             Client Name: %5            Client Address: %6
				
   Event ID: 683 (0x02ab)
       Type: Success Audit
Description: Session disconnected from winstation:
             User Name: %1              Domain: %2
             Logon ID: %3               Session Name: %4
             Client Name: %5            Client Address: %6
				
Keywords: 
kbinfo KB301677
Share
Additional support options
Ask The Microsoft Small Business Support Community
Contact Microsoft Small Business Support
Find Microsoft Small Business Support Certified Partner
Find a Microsoft Store For In-Person Small Business Support