Security Event IDs from Active Directory Used with User-ID Agent

Security Event IDs from Active Directory Used with User-ID Agent

75263
Created On 09/26/18 13:55 PM - Last Modified 11/21/20 04:04 AM


Environment


  • Windows-based User-ID Agent.
  • Any version.

Resolution


2000 - 2003

 

  • SUCCESS_NET_LOGON = 540
  • AUTH_TICKET_GRANTED = 672
  • SERVICE_TICKET_GRANTED = 673
  • TICKET_GRANTED_RENEW = 674 

2008 and above.

  • LOGON_SUCCESS_W2008 = 4624
  • AUTH_TICKET_GRANTED_W2008 = 4768
  • SERVICE_TICKET_GRANTED = 4769
  • TICKET_GRANTED_RENEW_W2008 = 4770 

 
Other users also viewed:
Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm17CAC&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Choose Language