Windows Event ID Database & Troubleshooting
Windows Event ID Database
Search for an ID, source or symptom to quickly understand common Windows events.
Application crash
Windows recorded an application crash.
Windows bug check (blue screen)
Windows recorded information about a blue-screen crash or bug check.
DCOM server registration timeout
A DCOM component failed to register within the expected time.
Insufficient DCOM permissions
A COM/DCOM application attempted activation without the expected permissions.
Unhandled .NET exception
A .NET application encountered an unhandled exception.
Group Policy file read failure
Windows could not read a file required to apply Group Policy.
Shutdown or restart initiated by a process
A process or user requested a planned shutdown or restart.
Security audit log cleared
The Windows Security event log was cleared.
Group Policy processing failed: domain unavailable
Windows could not process Group Policy because domain connectivity was insufficient.
Successful RDP authentication
Remote Desktop Services successfully authenticated a user.
Unexpected VSS error
Volume Shadow Copy Service reported an unexpected error during a snapshot operation.
Storage device reset
The storage driver reset a device or command after a timeout.
Certificate auto-enrollment failure
Windows failed to automatically enroll a requested certificate.
Active Directory replication topology issue
The Knowledge Consistency Checker could not build a complete replication topology.
Disk I/O operation retried
An input/output operation had to be retried.
Active Directory replication overdue
A domain controller has not received recent replication from some partners.
Windows Update installation succeeded
Windows Update reports that an update was successfully installed.
Windows Update installation failed
Windows Update failed to install an update.
Low virtual memory condition
Windows detected memory pressure and identified resource-intensive processes.
Replication blocked after tombstone lifetime
Active Directory blocked replication with a partner offline longer than the tombstone lifetime.
Unable to resolve AD replication partner
A domain controller could not resolve a replication partner through DNS.
RDP session logon
A Remote Desktop Services session was successfully opened.
RDP session disconnected
An RDP session was disconnected but not necessarily signed out.
RDP session reconnected
A user reconnected to an existing RDP session.
Fatal TLS alert received
Schannel received a fatal TLS alert from the remote peer.
Fatal TLS alert generated
Schannel generated a fatal TLS alert during negotiation.
Unexpected restart (Kernel-Power)
Windows restarted without a complete, orderly shutdown.
System time changed
The system clock was changed.
Successful logon
Windows accepted a logon attempt.
Account logoff
A Windows logon session ended.
User-initiated logoff
A user explicitly initiated sign-out.
Logon using explicit credentials
A process attempted to use explicitly supplied credentials.
Access to an audited object
A process accessed a file, folder or object with auditing enabled.
Special privileges assigned at logon
A logon session received administrative or sensitive privileges.
New process created
Windows created a process while process creation auditing was enabled.
Service installed
A new service was installed on the system.
Scheduled task created
A new scheduled task was created.
Scheduled task updated
An existing scheduled task was modified.
System audit policy changed
The Windows audit policy was modified.
User account created
A new user account was created.
User account enabled
A previously disabled user account was enabled.
Password reset attempted
An attempt was made to reset another account's password.
User account disabled
A user account was disabled.
User account deleted
A user account was deleted.
Member added to global security group
A member was added to a global security group.
Member added to local security group
A member was added to a local security group.
User account changed
One or more attributes of a user account were modified.
User account locked out
An account was locked after failed authentication attempts.
User account unlocked
A locked account was unlocked.
Kerberos TGT requested
A client requested a Kerberos Ticket Granting Ticket from a domain controller.
NTLM credential validation
A domain controller or system validated credentials using NTLM.
Disk paging I/O error
Windows encountered an input/output error during paging.
Network share accessed
A network share was accessed.
Detailed network share access check
Windows checked whether a client could access a shared file or folder.
Connection blocked by Windows Filtering Platform
Windows Filtering Platform blocked a connection.
NTFS corruption detected
NTFS detected an inconsistency or corruption on a volume.
Windows Event Log service started
The Windows Event Log service started, often after system startup.
Windows Event Log service stopped cleanly
The Event Log service stopped cleanly, generally during a normal shutdown.
Previous shutdown was unexpected
Windows reported that the previous shutdown was unexpected.
Bad block detected on disk
The disk subsystem reported a bad block.
Service failed to start
A Windows service failed to start.
Service dependency failed
A service did not start because a required dependency was unavailable.
Service start timeout
The Service Control Manager exceeded its startup waiting period.
Service response timeout
A service failed to respond in time to a Service Control Manager request.
Service stopped with an error
A service terminated and returned an error.
Service terminated unexpectedly
A service terminated unexpectedly without a specified recovery action.
Service state changed
A service changed state to running or stopped.
Service startup type changed
A service startup configuration was changed.
New service registered
A new Windows service was registered.
Internal VSS operation failed
Volume Shadow Copy Service encountered an error during an internal operation.