Microsoft KB Archive/301677

= Windows 2000 Security Event Descriptions (Part 2 of 2) =

Article ID: 301677

Article Last Modified on 1/31/2007

-

APPLIES TO


 * Microsoft Windows 2000 Service Pack 1
 * Microsoft Windows 2000 Service Pack 2
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows 2000 Service Pack 1
 * Microsoft Windows 2000 Service Pack 2
 * Microsoft Windows 2000 Service Pack 2

-



This article was previously published under Q301677



SUMMARY
This article contains descriptions of various security-related and auditing-related events, and information about how to interpret these events. These events will all appear in the Security event log and will be logged with a source of &quot;Security.&quot; The following article in the Microsoft Knowledge Base is Part 1 of 2:

299475 Windows 2000 Security Event Descriptions (Part 1 of 2)



MORE INFORMATION
  Event ID: 608 (0x0260) Type: Success Audit Description: User Right Assigned User Right: %1            Assigned To: %2 Assigned By User Name: %3              Domain: %4 Logon ID: %5   Event ID: 609 (0x0261) Type: Success Audit Description: User Right Removed User Right: %1            Removed From: %2 Removed By: User Name: %3              Domain: %4 Logon ID: %5   Event ID: 610 (0x0262) Type: Success Audit Description: New Trusted Domain Domain Name: %1           Domain ID: %2 Established By: User Name: %3             Domain: %4 Logon ID: %5   Event ID: 611 (0x0263) Type: Success Audit Description: Removing Trusted Domain Domain Name: %1           Domain ID: %2 Removed By: User Name: %3              Domain: %4 Logon ID: %5   Event ID: 612 (0x0264) Type: Success Audit Description: Audit Policy Change New Policy: Success  Failure %1        %2    System %3        %4    Logon/Logoff %5        %6    Object Access %7        %8    Privilege Use %9       %10    Detailed Tracking %11       %12    Policy Change %13       %14    Account Management Changed By: User Name: %15            Domain Name: %16 Logon ID: %17   Event ID: 613 (0x0265) Type: Success Audit Description: IPSec policy agent started Ipsec Policy Agent: %1    Policy Source:  %2 Event Data: %3   Event ID: 614 (0x0266) Type: Success Audit Description: IPSec policy agent disabled Ipsec Policy Agent: %1    Event Data:  %2   Event ID: 615 (0x0267) Type: Success Audit Description: IPSEC PolicyAgent Service: %1 Event Data: %1   Event ID: 616 (0x0268) Type: Failure Audit Description: IPSec policy agent encountered a potentially serious failure. Event Data: %1   Event ID: 617 (0x0269) Type: Success Audit Description: Kerberos Policy Changed Changed By: User Name: %1              Domain Name: %2 Logon ID: %3 Changes made: %4 '-' means no changes, otherwise each change is shown as: Parameter Name: (new value) (old value)   Event ID: 618 (0x026a) Type: Success Audit Description: Encrypted Data Recovery Policy Changed Changed By: User Name: %1              Domain Name: %2 Logon ID: %3 Changes made: %4 '-' means no changes, otherwise each change is shown as: Parameter Name: new value (old value)   Event ID: 619 (0x026b) Type: Success Audit Description: Quality of Service Policy Changed Changed By: User Name: %1              Domain Name: %2 Logon ID: %3 Changes made: %4 '-' means no changes, otherwise each change is shown as: Parameter Name: new value (old value)   Event ID: 620 (0x026C) Description: Trusted Domain Information Modified: Domain Name: %1           Domain ID: %2 Modified By: User Name: %3             Domain: %4 Logon ID: %5 <pre class="fixed_text">  Event ID: 624 (0x0270) Type: Success Audit Description: User Account Created New Account Name: %1      New Domain: %2 New Account ID: %3 Caller User Name: %4      Caller Domain: %5 Caller Logon ID: %6       Privileges %7 <pre class="fixed_text">  Event ID: 625 (0x0271) Description: User Account Type Change Type: Success Audit Target Account Name: %1   Target Domain: %2 Target Account ID: %3 New Type: %4              Caller User Name: %5 Caller Domain: %6         Caller Logon ID: %7 <pre class="fixed_text">  Event ID: 626 (0x0272) Description: User Account Enabled Type: Success Audit Target Account Name: %1   Target Domain: %2 Target Account ID: %3 Caller User Name: %4      Caller Domain: %5 Caller Logon ID: %6 Note Windows 2000 does not log event ID 626 explicitly. Results are logged as a part of event ID 642 in the description of the message. <pre class="fixed_text">  Event ID: 627 (0x0273) Type: Success Audit Description: Change Password Attempt Target Account Name: %1   Target Domain: %2 Target Account ID: %3 Caller User Name: %4      Caller Domain: %5 Caller Logon ID: %6       Privileges: %7 <pre class="fixed_text">  Event ID: 628 (0x0274) Type: Success Audit Description: User Account password set Target Account Name: %1   Target Domain: %2 Target Account ID: %3 Caller User Name: %4      Caller Domain: %5 Caller Logon ID: %6 <pre class="fixed_text">  Event ID: 630 (0x0276) Type: Success Audit Description: User Account Deleted: Target Account Name: %1   Target Domain: %2 Target Account ID: %3 Caller User Name: %4      Caller Domain: %5 Caller Logon ID: %6       Privileges: %7 <pre class="fixed_text">  Event ID: 631 (0x0277) Type: Success Audit Description: Security Enabled Global Group Created New Account Name: %1      New Domain: %2 New Account ID: %3 Caller User Name: %4      Caller Domain: %5 Caller Logon ID: %6       Privileges: %7 <pre class="fixed_text">  Event ID: 632 (0x0278) Type: Success Audit Description: Security Enabled Global Group Member Added Member Name: %1           Member ID: %2 Target Account Name: %3   Target Domain: %4 Target Account ID: %5 Caller User Name: %6      Caller Domain: %7 Caller Logon ID: %8       Privileges: %9 <pre class="fixed_text">  Event ID: 633 (0x0279) Type: Success Audit Description: Security Enabled Global Group Member Removed Member Name: %1           Member ID: %2 Target Account Name: %3   Target Domain: %4 Target Account ID: %5 Caller User Name: %6      Caller Domain: %7 Caller Logon ID: %8       Privileges: %9 <pre class="fixed_text">  Event ID: 634 (0x027A) Type: Success Audit Description: Security Enabled Global Group Deleted Target Account Name: %1   Target Domain: %2 Target Account ID: %3 Caller User Name: %4      Caller Domain: %5 Caller Logon ID: %6       Privileges: %7 <pre class="fixed_text">  Event ID: 635 (0x027B) Type: Success Audit Description: Security Enabled Local Group Created New Account Name: %1      New Domain: %2 New Account ID: %3 Caller User Name: %4      Caller Domain: %5 Caller Logon ID: %6       Privileges: %7 <pre class="fixed_text">  Event ID: 636 (0x027C) Type: Success Audit

Description: Security Enabled Local Group Member Added Member Name: %1           Member ID: %2 Target Account Name: %3   Target Domain: %4 Target Account ID: %5 Caller User Name: %6      Caller Domain: %7 Caller Logon ID: %8       Privileges: %9 <pre class="fixed_text">  Event ID: 637 (0x027D) Type: Success Audit Description: Security Enabled Local Group Member Removed Member Name: %1           Member ID: %2 Target Account Name: %3   Target Domain: %4 Target Account ID: %5 Caller User Name: %6      Caller Domain: %7 Caller Logon ID: %8       Privileges: %9 <pre class="fixed_text">  Event ID: 638 (0x027E) Type: Success Audit Description: Security Enabled Local Group Deleted Target Account Name: %1   Target Domain: %2 Target Account ID: %3 Caller User Name: %4      Caller Domain: %5 Caller Logon ID: %6       Privileges: %7 <pre class="fixed_text">  Event ID: 639 (0x027F) Type: Success Audit Description: Security Enabled Local Group Changed Target Account Name: %1   Target Domain: %2 Target Account ID: %3 Caller User Name: %4      Caller Domain: %5 Caller Logon ID: %6       Privileges: %7 <pre class="fixed_text">  Event ID: 640 (0x0280) Type: Success Audit Description: General Account Database Change Type of change: %1        Object Type: %2 Object Name: %3           Object ID: %4 Caller User Name: %5      Caller Domain: %6 Caller Logon ID: %7 <pre class="fixed_text">  Event ID: 641 (0x0281) Type: Success Audit Description: Security Enabled Global Group Changed Target Account Name: %1   Target Domain: %2 Target Account ID: %3 Caller User Name: %4      Caller Domain: %5 Caller Logon ID: %6       Privileges: %7 <pre class="fixed_text">  Event ID: 642 (0x0282) Type: Success Audit Description: User Account Changed Target Account Name: %1   Target Domain: %2 Target Account ID: %3 Caller User Name: %4      Caller Domain: %5 Caller Logon ID: %6       Privileges: %7 <pre class="fixed_text">  Event ID: 643 (0x0283) Type: Success Audit Description: Domain Policy Changed: %1 modified Domain: %2                Domain ID: %3 Caller User Name: %4      Caller Domain: %5 Caller Logon ID: %6       Privileges: %7 <pre class="fixed_text">  Event ID: 644 (0x0284) Type: Success Audit Description: User Account Locked Out Target Account Name: %1   Target Account ID: %3 Caller Machine Name: %2 Caller User Name: %4      Caller Domain: %5 Caller Logon ID: %6 <pre class="fixed_text">  Event ID: 645 (0x0285) Type: Success Audit Description: Computer Account Created New Account Name: %1      New Domain: %2 New Account ID: %3 Caller User Name: %4      Caller Domain: %5 Caller Logon ID: %6       Privileges %7 <pre class="fixed_text">  Event ID: 646 (0x0286) Type: Success Audit Description: Computer Account Changed Target Account Name: %1   Target Domain: %2 Target Account ID: %3 Caller User Name: %5      Caller Domain: %6 Caller Logon ID: %7       Privileges: %8 <pre class="fixed_text">  Event ID: 647 (0x0287) Type: Success Audit Description: Computer Account Deleted Target Account Name: %1   Target Domain: %2 Target Account ID: %3 Caller User Name: %4      Caller Domain: %5 Caller Logon ID: %6       Privileges: %7 <pre class="fixed_text">  Event ID: 648 (0x0288) Type: Success Audit Description: Security Disabled Local Group Created Target Account Name: %1   Target Domain: %2 Target Account ID: %3 Caller User Name: %4      Caller Domain: %5

Caller Logon ID: %6       Privileges: %7 <pre class="fixed_text">  Event ID: 649 (0x0289) Type: Success Audit Description: Security Disabled Local Group Changed Target Account Name: %1   Target Domain: %2 Target Account ID: %3 Caller User Name: %4      Caller Domain: %5 Caller Logon ID: %6       Privileges: %7 <pre class="fixed_text">  Event ID: 650 (0x028A) Type: Success Audit Description: Security Disabled Local Group Member Added Member Name: %1           Member ID: %2 Target Account Name: %3   Target Domain: %4 Target Account ID: %5 Caller User Name: %6      Caller Domain: %7 Caller Logon ID: %8       Privileges: %9 <pre class="fixed_text">  Event ID: 651 (0x028B) Type: Success Audit Description: Security Disabled Local Group Member Removed Member Name: %1           Member ID: %2 Target Account Name: %3   Target Domain: %4 Target Account ID: %5 Caller User Name: %6      Caller Domain: %7 Caller Logon ID: %8       Privileges: %9 <pre class="fixed_text">  Event ID: 652 (0x028C) Type: Success Audit Description: Security Disabled Local Group Deleted Target Account Name: %1   Target Domain: %2 Target Account ID: %3 Caller User Name: %4      Caller Domain: %5 Caller Logon ID: %6       Privileges: %7 <pre class="fixed_text">  Event ID: 653 (0x028D) Type: Success Audit Description: Security Disabled Global Group Created New Account Name: %1      New Domain: %2 New Account ID: %3 Caller User Name: %4      Caller Domain: %5 Caller Logon ID: %6       Privileges: %7 <pre class="fixed_text">  Event ID: 654 (0x028E) Type: Success Audit Description: Security Disabled Global Group Changed Target Account Name: %1   Target Domain: %2 Target Account ID: %3 Caller User Name: %4      Caller Domain: %5 Caller Logon ID: %6       Privileges: %7 <pre class="fixed_text">  Event ID: 655 (0x028F) Type: Success Audit Description: Security Disabled Global Group Member Added Member Name: %1           Member ID: %2 Target Account Name: %3   Target Domain: %4 Target Account ID: %5 Caller User Name: %6      Caller Domain: %7 Caller Logon ID: %8       Privileges: %9 <pre class="fixed_text">  Event ID: 656 (0x0290) Type: Success Audit Description: Security Disabled Global Group Member Removed Member Name: %1           Member ID: %2 Target Account Name: %3   Target Domain: %4 Target Account ID: %5 Caller User Name: %6      Caller Domain: %7 Caller Logon ID: %8       Privileges: %9 <pre class="fixed_text">  Event ID: 657 (0x0291) Type: Success Audit Description: Security Disabled Global Group Deleted Target Account Name: %1   Target Domain: %2 Target Account ID: %3 Caller User Name: %4      Caller Domain: %5 Caller Logon ID: %6       Privileges: %7 <pre class="fixed_text">  Event ID: 658 (0x0292) Type: Success Audit Description: Security Enabled Universal Group Created New Account Name: %1      New Domain: %2 New Account ID: %3 Caller User Name: %4      Caller Domain: %5 Caller Logon ID: %6       Privileges: %7 <pre class="fixed_text">  Event ID: 659 (0x0293) Type: Success Audit Description: Security Enabled Universal Group Changed Target Account Name: %1   Target Domain: %2 Target Account ID: %3 Caller User Name: %4      Caller Domain: %5 Caller Logon ID: %6       Privileges: %7 <pre class="fixed_text">  Event ID: 660 (0x0294) Type: Success Audit Description: Security Enabled Universal Group Member Added Member Name: %1           Member ID: %2 Target Account Name: %3   Target Domain: %4 Target Account ID: %5 Caller User Name: %6      Caller Domain: %7 Caller Logon ID: %8       Privileges: %9 <pre class="fixed_text">  Event ID: 661 (0x0295) Type: Success Audit Description: Security Enabled Universal Group Member Removed Member Name: %1           Member ID: %2 Target Account Name: %3   Target Domain: %4 Target Account ID: %5 Caller User Name: %6      Caller Domain: %7 Caller Logon ID: %8       Privileges: %9 <pre class="fixed_text">  Event ID: 662 (0x0296) Type: Success Audit Description: Security Enabled Universal Group Deleted Target Account Name: %1   Target Domain: %2 Target Account ID: %3 Caller User Name: %4      Caller Domain: %5 Caller Logon ID: %6       Privileges: %7 <pre class="fixed_text">  Event ID: 663 (0x0297) Type: Success Audit Description: Security Disabled Universal Group Created New Account Name: %1      New Domain: %2 New Account ID: %3 Caller User Name: %4      Caller Domain: %5 Caller Logon ID: %6       Privileges: %7 <pre class="fixed_text">  Event ID: 664 (0x0298) Type: Success Audit Description: Security Disabled Universal Group Changed Target Account Name: %1   Target Domain: %2 Target Account ID: %3 Caller User Name: %4      Caller Domain: %5 Caller Logon ID: %6       Privileges: %7 <pre class="fixed_text">  Event ID: 665 (0x0299) Type: Success Audit Description: Security Disabled Universal Group Member Added Member Name: %1           Member ID: %2 Target Account Name: %3   Target Domain: %4 Target Account ID: %5 Caller User Name: %6      Caller Domain: %7 Caller Logon ID: %8       Privileges: %9 <pre class="fixed_text">  Event ID: 666 (0x029A) Type: Success Audit Description: Security Disabled Universal Group Member Removed Member Name: %1           Member ID: %2 Target Account Name: %3   Target Domain: %4 Target Account ID: %5 Caller User Name: %6      Caller Domain: %7 Caller Logon ID: %8       Privileges: %9 <pre class="fixed_text">  Event ID: 667 (0x029B) Type: Success Audit Description: Security Disabled Universal Group Deleted Target Account Name: %1   Target Domain: %2 Target Account ID: %3 Caller User Name: %4      Caller Domain: %5 Caller Logon ID: %6       Privileges: %7 <pre class="fixed_text">  Event ID: 668 (0x029C) Type: Success Audit Description: Group Type Changed Target Account Name: %1   Target Domain: %2 Target Account ID: %3 Caller User Name: %5      Caller Domain: %6 Caller Logon ID: %7       Privileges: %8 <pre class="fixed_text">  Event ID: 669 (0x029D) Type: Success Audit Description: Add SID History Source Account Name: %1   Source Account ID: %2 Target Account Name: %3   Target Domain: %4 Target Account ID: %5 Caller User Name: %6      Caller Domain: %7 Caller Logon ID: %8       Privileges: %9 <pre class="fixed_text">  Event ID: 670 (0x029E) Type: Success Audit Description: Add SID History Source Account Name: %1   Target Account Name: %2 Target Domain: %3         Target Account ID: %4 Caller User Name: %5      Caller Domain: %6 Caller Logon ID: %7       Privileges: %8 <pre class="fixed_text">  Event ID: 672 (0x02a0) Type: Success Audit Description: Authentication Ticket Granted User Name: %1             Supplied Realm Name: %2 User ID: %3               Service Name: %4 Service ID: %5            Ticket Options: %6 Ticket Encryption Type: %7 Pre-Authentication Type: %8 Client Address: %9 <pre class="fixed_text">  Event ID: 673 (0x02a1) Type: Success Audit Description: Service Ticket Granted User Name: %1             User Domain: %2 Service Name: %3          Service ID: %4 Ticket Options: %5        Ticket Encryption Type: %6 Client Address: %7 <pre class="fixed_text">  Event ID: 674 (0x02a2) Type: Success Audit Description: Ticket Granted Renewed User Name: %1             User Domain: %2 Service Name: %3          Service ID: %4 Ticket Options: %5        Ticket Encryption Type: %6 Client Address: %7 <pre class="fixed_text">  Event ID: 675 (0x02a3) Type: Failure Audit Description: Pre-authentication failed User Name: %1             User ID: %2 Service Name: %3          Pre-Authentication Type: %4 Failure Code: %5          Client Address: %6 <pre class="fixed_text">  Event ID: 676 (0x02a4) Type: Failure Audit Description: Authentication Ticket Request Failed User Name: %1             Supplied Realm Name: %2 Service Name: %3          Ticket Options: %4 Failure Code: %5          Client Address: %6 <pre class="fixed_text">  Event ID: 677 (0x02a5) Type: Failure Audit Description: Service Ticket Request Failed: Description: Authentication Ticket Request Failed User Name: %1             Supplied Realm Name: %2 Service Name: %3          Ticket Options: %4 Failure Code: %5          Client Address: %6 <pre class="fixed_text">  Event ID: 678 (0x02a6) Type: Success Audit Description: Account Mapped for Logon by: %1 Client Name: %2           Mapped Name:%3 <pre class="fixed_text">  Event ID: 679 (0x02a7) Type: Failure Audit Description: The name: %2 could not be mapped for logon by: %1 <pre class="fixed_text">  Event ID: 680 (0x02a8) Type: Success Audit Description: Account Used for Logon by: %1 Account Name: %2          Workstation: %3 <pre class="fixed_text">  Event ID: 681 (0x02a9) Type: Failure Audit Description: The logon to account: %2 by: %1 from workstation: %3 failed. The error code was: %4 <pre class="fixed_text">  Event ID: 682 (0x02aa) Type: Success Audit Description: Session reconnected to winstation: User Name: %1             Domain: %2 Logon ID: %3              Session Name: %4 Client Name: %5           Client Address: %6 <pre class="fixed_text">  Event ID: 683 (0x02ab) Type: Success Audit Description: Session disconnected from winstation: User Name: %1             Domain: %2 Logon ID: %3              Session Name: %4 Client Name: %5           Client Address: %6

Keywords: kbinfo KB301677

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.