mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-22 22:03:46 +00:00
fixing merge conflict
This commit is contained in:
Brian Lich
@ -163,63 +163,326 @@
|
||||
###### [Monitor claim types](monitor-claim-types.md)
|
||||
##### [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)
|
||||
###### [Audit Credential Validation](audit-credential-validation.md)
|
||||
###### [Audit Kerberos Authentication Service ](audit-kerberos-authentication-service.md)
|
||||
####### [Event 4774 S: An account was mapped for logon.](event-4774.md)
|
||||
####### [Event 4775 F: An account could not be mapped for logon.](event-4775.md)
|
||||
####### [Event 4776 S, F: The computer attempted to validate the credentials for an account.](event-4776.md)
|
||||
####### [Event 4777 F: The domain controller failed to validate the credentials for an account.](event-4777.md)
|
||||
###### [Audit Kerberos Authentication Service](audit-kerberos-authentication-service.md)
|
||||
####### [Event 4768 S, F: A Kerberos authentication ticket, TGT, was requested.](event-4768.md)
|
||||
####### [Event 4771 F: Kerberos pre-authentication failed.](event-4771.md)
|
||||
####### [Event 4772 F: A Kerberos authentication ticket request failed.](event-4772.md)
|
||||
###### [Audit Kerberos Service Ticket Operations](audit-kerberos-service-ticket-operations.md)
|
||||
###### [Audit Other Account Logon Events ](audit-other-account-logon-events.md)
|
||||
####### [Event 4769 S, F: A Kerberos service ticket was requested.](event-4769.md)
|
||||
####### [Event 4770 S: A Kerberos service ticket was renewed.](event-4770.md)
|
||||
####### [Event 4773 F: A Kerberos service ticket request failed.](event-4773.md)
|
||||
###### [Audit Other Account Logon Events](audit-other-account-logon-events.md)
|
||||
###### [Audit Application Group Management](audit-application-group-management.md)
|
||||
###### [Audit Computer Account Management](audit-computer-account-management.md)
|
||||
####### [Event 4741 S: A computer account was created.](event-4741.md)
|
||||
####### [Event 4742 S: A computer account was changed.](event-4742.md)
|
||||
####### [Event 4743 S: A computer account was deleted.](event-4743.md)
|
||||
###### [Audit Distribution Group Management](audit-distribution-group-management.md)
|
||||
####### [Event 4749 S: A security-disabled global group was created.](event-4749.md)
|
||||
####### [Event 4750 S: A security-disabled global group was changed.](event-4750.md)
|
||||
####### [Event 4751 S: A member was added to a security-disabled global group.](event-4751.md)
|
||||
####### [Event 4752 S: A member was removed from a security-disabled global group.](event-4752.md)
|
||||
####### [Event 4753 S: A security-disabled global group was deleted.](event-4753.md)
|
||||
###### [Audit Other Account Management Events](audit-other-account-management-events.md)
|
||||
####### [Event 4782 S: The password hash an account was accessed.](event-4782.md)
|
||||
####### [Event 4793 S: The Password Policy Checking API was called.](event-4793.md)
|
||||
###### [Audit Security Group Management](audit-security-group-management.md)
|
||||
####### [Event 4731 S: A security-enabled local group was created.](event-4731.md)
|
||||
####### [Event 4732 S: A member was added to a security-enabled local group.](event-4732.md)
|
||||
####### [Event 4733 S: A member was removed from a security-enabled local group.](event-4733.md)
|
||||
####### [Event 4734 S: A security-enabled local group was deleted.](event-4734.md)
|
||||
####### [Event 4735 S: A security-enabled local group was changed.](event-4735.md)
|
||||
####### [Event 4764 S: A group’s type was changed.](event-4764.md)
|
||||
####### [Event 4799 S: A security-enabled local group membership was enumerated.](event-4799.md)
|
||||
###### [Audit User Account Management](audit-user-account-management.md)
|
||||
####### [Event 4720 S: A user account was created.](event-4720.md)
|
||||
####### [Event 4722 S: A user account was enabled.](event-4722.md)
|
||||
####### [Event 4723 S, F: An attempt was made to change an account's password.](event-4723.md)
|
||||
####### [Event 4724 S, F: An attempt was made to reset an account's password.](event-4724.md)
|
||||
####### [Event 4725 S: A user account was disabled.](event-4725.md)
|
||||
####### [Event 4726 S: A user account was deleted.](event-4726.md)
|
||||
####### [Event 4738 S: A user account was changed.](event-4738.md)
|
||||
####### [Event 4740 S: A user account was locked out.](event-4740.md)
|
||||
####### [Event 4765 S: SID History was added to an account.](event-4765.md)
|
||||
####### [Event 4766 F: An attempt to add SID History to an account failed.](event-4766.md)
|
||||
####### [Event 4767 S: A user account was unlocked.](event-4767.md)
|
||||
####### [Event 4780 S: The ACL was set on accounts which are members of administrators groups.](event-4780.md)
|
||||
####### [Event 4781 S: The name of an account was changed.](event-4781.md)
|
||||
####### [Event 4794 S, F: An attempt was made to set the Directory Services Restore Mode administrator password.](event-4794.md)
|
||||
####### [Event 4798 S: A user's local group membership was enumerated.](event-4798.md)
|
||||
####### [Event 5376 S: Credential Manager credentials were backed up.](event-5376.md)
|
||||
####### [Event 5377 S: Credential Manager credentials were restored from a backup.](event-5377.md)
|
||||
###### [Audit DPAPI Activity](audit-dpapi-activity.md)
|
||||
####### [Event 4692 S, F: Backup of data protection master key was attempted.](event-4692.md)
|
||||
####### [Event 4693 S, F: Recovery of data protection master key was attempted.](event-4693.md)
|
||||
####### [Event 4694 S, F: Protection of auditable protected data was attempted.](event-4694.md)
|
||||
####### [Event 4695 S, F: Unprotection of auditable protected data was attempted.](event-4695.md)
|
||||
###### [Audit PNP Activity](audit-pnp-activity.md)
|
||||
####### [Event 6416 S: A new external device was recognized by the System.](event-6416.md)
|
||||
####### [Event 6419 S: A request was made to disable a device.](event-6419.md)
|
||||
####### [Event 6420 S: A device was disabled.](event-6420.md)
|
||||
####### [Event 6421 S: A request was made to enable a device.](event-6421.md)
|
||||
####### [Event 6422 S: A device was enabled.](event-6422.md)
|
||||
####### [Event 6423 S: The installation of this device is forbidden by system policy.](event-6423.md)
|
||||
####### [Event 6424 S: The installation of this device was allowed, after having previously been forbidden by policy.](event-6424.md)
|
||||
###### [Audit Process Creation](audit-process-creation.md)
|
||||
###### [Audit Process Termination ](audit-process-termination.md)
|
||||
####### [Event 4688 S: A new process has been created.](event-4688.md)
|
||||
####### [Event 4696 S: A primary token was assigned to process.](event-4696.md)
|
||||
###### [Audit Process Termination](audit-process-termination.md)
|
||||
####### [Event 4689 S: A process has exited.](event-4689.md)
|
||||
###### [Audit RPC Events](audit-rpc-events.md)
|
||||
####### [Event 5712 S: A Remote Procedure Call, RPC, was attempted.](event-5712.md)
|
||||
###### [Audit Detailed Directory Service Replication](audit-detailed-directory-service-replication.md)
|
||||
####### [Event 4928 S, F: An Active Directory replica source naming context was established.](event-4928.md)
|
||||
####### [Event 4929 S, F: An Active Directory replica source naming context was removed.](event-4929.md)
|
||||
####### [Event 4930 S, F: An Active Directory replica source naming context was modified.](event-4930.md)
|
||||
####### [Event 4931 S, F: An Active Directory replica destination naming context was modified.](event-4931.md)
|
||||
####### [Event 4934 S: Attributes of an Active Directory object were replicated.](event-4934.md)
|
||||
####### [Event 4935 F: Replication failure begins.](event-4935.md)
|
||||
####### [Event 4936 S: Replication failure ends.](event-4936.md)
|
||||
####### [Event 4937 S: A lingering object was removed from a replica.](event-4937.md)
|
||||
###### [Audit Directory Service Access](audit-directory-service-access.md)
|
||||
####### [Event 4662 S, F: An operation was performed on an object.](event-4662.md)
|
||||
####### [Event 4661 S, F: A handle to an object was requested.](event-4661.md)
|
||||
###### [Audit Directory Service Changes](audit-directory-service-changes.md)
|
||||
####### [Event 5136 S: A directory service object was modified.](event-5136.md)
|
||||
####### [Event 5137 S: A directory service object was created.](event-5137.md)
|
||||
####### [Event 5138 S: A directory service object was undeleted.](event-5138.md)
|
||||
####### [Event 5139 S: A directory service object was moved.](event-5139.md)
|
||||
####### [Event 5141 S: A directory service object was deleted.](event-5141.md)
|
||||
###### [Audit Directory Service Replication](audit-directory-service-replication.md)
|
||||
###### [Audit Account Lockout ](audit-account-lockout.md)
|
||||
####### [Event 4932 S: Synchronization of a replica of an Active Directory naming context has begun.](event-4932.md)
|
||||
####### [Event 4933 S, F: Synchronization of a replica of an Active Directory naming context has ended.](event-4933.md)
|
||||
###### [Audit Account Lockout](audit-account-lockout.md)
|
||||
####### [Event 4625 F: An account failed to log on.](event-4625.md)
|
||||
###### [Audit User/Device Claims](audit-user-device-claims.md)
|
||||
####### [Event 4626 S: User/Device claims information.](event-4626.md)
|
||||
###### [Audit Group Membership](audit-group-membership.md)
|
||||
####### [Event 4627 S: Group membership information.](event-4627.md)
|
||||
###### [Audit IPsec Extended Mode](audit-ipsec-extended-mode.md)
|
||||
###### [Audit IPsec Main Mode](audit-ipsec-main-mode.md)
|
||||
###### [Audit IPsec Quick Mode](audit-ipsec-quick-mode.md)
|
||||
###### [Audit Logoff](audit-logoff.md)
|
||||
####### [Event 4634 S: An account was logged off.](event-4634.md)
|
||||
####### [Event 4647 S: User initiated logoff.](event-4647.md)
|
||||
###### [Audit Logon](audit-logon.md)
|
||||
####### [Event 4624 S: An account was successfully logged on.](event-4624.md)
|
||||
####### [Event 4625 F: An account failed to log on.](event-4625.md)
|
||||
####### [Event 4648 S: A logon was attempted using explicit credentials.](event-4648.md)
|
||||
####### [Event 4675 S: SIDs were filtered.](event-4675.md)
|
||||
###### [Audit Network Policy Server](audit-network-policy-server.md)
|
||||
###### [Audit Other Logon/Logoff Events](audit-other-logonlogoff-events.md)
|
||||
####### [Event 4649 S: A replay attack was detected.](event-4649.md)
|
||||
####### [Event 4778 S: A session was reconnected to a Window Station.](event-4778.md)
|
||||
####### [Event 4779 S: A session was disconnected from a Window Station.](event-4779.md)
|
||||
####### [Event 4800 S: The workstation was locked.](event-4800.md)
|
||||
####### [Event 4801 S: The workstation was unlocked.](event-4801.md)
|
||||
####### [Event 4802 S: The screen saver was invoked.](event-4802.md)
|
||||
####### [Event 4803 S: The screen saver was dismissed.](event-4803.md)
|
||||
####### [Event 5378 F: The requested credentials delegation was disallowed by policy.](event-5378.md)
|
||||
####### [Event 5632 S, F: A request was made to authenticate to a wireless network.](event-5632.md)
|
||||
####### [Event 5633 S, F: A request was made to authenticate to a wired network.](event-5633.md)
|
||||
###### [Audit Special Logon](audit-special-logon.md)
|
||||
####### [Event 4964 S: Special groups have been assigned to a new logon.](event-4964.md)
|
||||
####### [Event 4672 S: Special privileges assigned to new logon.](event-4672.md)
|
||||
###### [Audit Application Generated](audit-application-generated.md)
|
||||
###### [Audit Certification Services](audit-certification-services.md)
|
||||
###### [Audit Detailed File Share ](audit-detailed-file-share.md)
|
||||
###### [Audit Detailed File Share](audit-detailed-file-share.md)
|
||||
####### [Event 5145 S, F: A network share object was checked to see whether client can be granted desired access.](event-5145.md)
|
||||
###### [Audit File Share](audit-file-share.md)
|
||||
####### [Event 5140 S, F: A network share object was accessed.](event-5140.md)
|
||||
####### [Event 5142 S: A network share object was added.](event-5142.md)
|
||||
####### [Event 5143 S: A network share object was modified.](event-5143.md)
|
||||
####### [Event 5144 S: A network share object was deleted.](event-5144.md)
|
||||
####### [Event 5168 F: SPN check for SMB/SMB2 failed.](event-5168.md)
|
||||
###### [Audit File System](audit-file-system.md)
|
||||
####### [Event 4656 S, F: A handle to an object was requested.](event-4656.md)
|
||||
####### [Event 4658 S: The handle to an object was closed.](event-4658.md)
|
||||
####### [Event 4660 S: An object was deleted.](event-4660.md)
|
||||
####### [Event 4663 S: An attempt was made to access an object.](event-4663.md)
|
||||
####### [Event 4664 S: An attempt was made to create a hard link.](event-4664.md)
|
||||
####### [Event 4985 S: The state of a transaction has changed.](event-4985.md)
|
||||
####### [Event 5051: A file was virtualized.](event-5051.md)
|
||||
####### [Event 4670 S: Permissions on an object were changed.](event-4670.md)
|
||||
###### [Audit Filtering Platform Connection](audit-filtering-platform-connection.md)
|
||||
###### [Audit Filtering Platform Packet Drop ](audit-filtering-platform-packet-drop.md)
|
||||
####### [Event 5031 F: The Windows Firewall Service blocked an application from accepting incoming connections on the network.](event-5031.md)
|
||||
####### [Event 5150: The Windows Filtering Platform blocked a packet.](event-5150.md)
|
||||
####### [Event 5151: A more restrictive Windows Filtering Platform filter has blocked a packet.](event-5151.md)
|
||||
####### [Event 5154 S: The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.](event-5154.md)
|
||||
####### [Event 5155 F: The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.](event-5155.md)
|
||||
####### [Event 5156 S: The Windows Filtering Platform has permitted a connection.](event-5156.md)
|
||||
####### [Event 5157 F: The Windows Filtering Platform has blocked a connection.](event-5157.md)
|
||||
####### [Event 5158 S: The Windows Filtering Platform has permitted a bind to a local port.](event-5158.md)
|
||||
####### [Event 5159 F: The Windows Filtering Platform has blocked a bind to a local port.](event-5159.md)
|
||||
###### [Audit Filtering Platform Packet Drop](audit-filtering-platform-packet-drop.md)
|
||||
####### [Event 5152 F: The Windows Filtering Platform blocked a packet.](event-5152.md)
|
||||
####### [Event 5153 S: A more restrictive Windows Filtering Platform filter has blocked a packet.](event-5153.md)
|
||||
###### [Audit Handle Manipulation](audit-handle-manipulation.md)
|
||||
###### [Audit Kernel Object ](audit-kernel-object.md)
|
||||
####### [Event 4690 S: An attempt was made to duplicate a handle to an object.](event-4690.md)
|
||||
###### [Audit Kernel Object](audit-kernel-object.md)
|
||||
####### [Event 4656 S, F: A handle to an object was requested.](event-4656.md)
|
||||
####### [Event 4658 S: The handle to an object was closed.](event-4658.md)
|
||||
####### [Event 4660 S: An object was deleted.](event-4660.md)
|
||||
####### [Event 4663 S: An attempt was made to access an object.](event-4663.md)
|
||||
###### [Audit Other Object Access Events](audit-other-object-access-events.md)
|
||||
####### [Event 4671: An application attempted to access a blocked ordinal through the TBS.](event-4671.md)
|
||||
####### [Event 4691 S: Indirect access to an object was requested.](event-4691.md)
|
||||
####### [Event 5148 F: The Windows Filtering Platform has detected a DoS attack and entered a defensive mode; packets associated with this attack will be discarded.](event-5148.md)
|
||||
####### [Event 5149 F: The DoS attack has subsided and normal processing is being resumed.](event-5149.md)
|
||||
####### [Event 4698 S: A scheduled task was created.](event-4698.md)
|
||||
####### [Event 4699 S: A scheduled task was deleted.](event-4699.md)
|
||||
####### [Event 4700 S: A scheduled task was enabled.](event-4700.md)
|
||||
####### [Event 4701 S: A scheduled task was disabled.](event-4701.md)
|
||||
####### [Event 4702 S: A scheduled task was updated.](event-4702.md)
|
||||
####### [Event 5888 S: An object in the COM+ Catalog was modified.](event-5888.md)
|
||||
####### [Event 5889 S: An object was deleted from the COM+ Catalog.](event-5889.md)
|
||||
####### [Event 5890 S: An object was added to the COM+ Catalog.](event-5890.md)
|
||||
###### [Audit Registry](audit-registry.md)
|
||||
####### [Event 4663 S: An attempt was made to access an object.](event-4663.md)
|
||||
####### [Event 4656 S, F: A handle to an object was requested.](event-4656.md)
|
||||
####### [Event 4658 S: The handle to an object was closed.](event-4658.md)
|
||||
####### [Event 4660 S: An object was deleted.](event-4660.md)
|
||||
####### [Event 4657 S: A registry value was modified.](event-4657.md)
|
||||
####### [Event 5039: A registry key was virtualized.](event-5039.md)
|
||||
####### [Event 4670 S: Permissions on an object were changed.](event-4670.md)
|
||||
###### [Audit Removable Storage](audit-removable-storage.md)
|
||||
###### [Audit SAM ](audit-sam.md)
|
||||
###### [Audit SAM](audit-sam.md)
|
||||
####### [Event 4661 S, F: A handle to an object was requested.](event-4661.md)
|
||||
###### [Audit Central Access Policy Staging](audit-central-access-policy-staging.md)
|
||||
####### [Event 4818 S: Proposed Central Access Policy does not grant the same access permissions as the current Central Access Policy.](event-4818.md)
|
||||
###### [Audit Audit Policy Change](audit-audit-policy-change.md)
|
||||
####### [Event 4670 S: Permissions on an object were changed.](event-4670.md)
|
||||
####### [Event 4715 S: The audit policy, SACL, on an object was changed.](event-4715.md)
|
||||
####### [Event 4719 S: System audit policy was changed.](event-4719.md)
|
||||
####### [Event 4817 S: Auditing settings on object were changed.](event-4817.md)
|
||||
####### [Event 4902 S: The Per-user audit policy table was created.](event-4902.md)
|
||||
####### [Event 4906 S: The CrashOnAuditFail value has changed.](event-4906.md)
|
||||
####### [Event 4907 S: Auditing settings on object were changed.](event-4907.md)
|
||||
####### [Event 4908 S: Special Groups Logon table modified.](event-4908.md)
|
||||
####### [Event 4912 S: Per User Audit Policy was changed.](event-4912.md)
|
||||
####### [Event 4904 S: An attempt was made to register a security event source.](event-4904.md)
|
||||
####### [Event 4905 S: An attempt was made to unregister a security event source.](event-4905.md)
|
||||
###### [Audit Authentication Policy Change](audit-authentication-policy-change.md)
|
||||
####### [Event 4706 S: A new trust was created to a domain.](event-4706.md)
|
||||
####### [Event 4707 S: A trust to a domain was removed.](event-4707.md)
|
||||
####### [Event 4716 S: Trusted domain information was modified.](event-4716.md)
|
||||
####### [Event 4713 S: Kerberos policy was changed.](event-4713.md)
|
||||
####### [Event 4717 S: System security access was granted to an account.](event-4717.md)
|
||||
####### [Event 4718 S: System security access was removed from an account.](event-4718.md)
|
||||
####### [Event 4739 S: Domain Policy was changed.](event-4739.md)
|
||||
####### [Event 4864 S: A namespace collision was detected.](event-4864.md)
|
||||
####### [Event 4865 S: A trusted forest information entry was added.](event-4865.md)
|
||||
####### [Event 4866 S: A trusted forest information entry was removed.](event-4866.md)
|
||||
####### [Event 4867 S: A trusted forest information entry was modified.](event-4867.md)
|
||||
###### [Audit Authorization Policy Change](audit-authorization-policy-change.md)
|
||||
####### [Event 4703 S: A user right was adjusted.](event-4703.md)
|
||||
####### [Event 4704 S: A user right was assigned.](event-4704.md)
|
||||
####### [Event 4705 S: A user right was removed.](event-4705.md)
|
||||
####### [Event 4670 S: Permissions on an object were changed.](event-4670.md)
|
||||
####### [Event 4911 S: Resource attributes of the object were changed.](event-4911.md)
|
||||
####### [Event 4913 S: Central Access Policy on the object was changed.](event-4913.md)
|
||||
###### [Audit Filtering Platform Policy Change](audit-filtering-platform-policy-change.md)
|
||||
###### [Audit MPSSVC Rule-Level Policy Change](audit-mpssvc-rule-level-policy-change.md)
|
||||
####### [Event 4944 S: The following policy was active when the Windows Firewall started.](event-4944.md)
|
||||
####### [Event 4945 S: A rule was listed when the Windows Firewall started.](event-4945.md)
|
||||
####### [Event 4946 S: A change has been made to Windows Firewall exception list. A rule was added.](event-4946.md)
|
||||
####### [Event 4947 S: A change has been made to Windows Firewall exception list. A rule was modified.](event-4947.md)
|
||||
####### [Event 4948 S: A change has been made to Windows Firewall exception list. A rule was deleted.](event-4948.md)
|
||||
####### [Event 4949 S: Windows Firewall settings were restored to the default values.](event-4949.md)
|
||||
####### [Event 4950 S: A Windows Firewall setting has changed.](event-4950.md)
|
||||
####### [Event 4951 F: A rule has been ignored because its major version number was not recognized by Windows Firewall.](event-4951.md)
|
||||
####### [Event 4952 F: Parts of a rule have been ignored because its minor version number was not recognized by Windows Firewall. The other parts of the rule will be enforced.](event-4952.md)
|
||||
####### [Event 4953 F: Windows Firewall ignored a rule because it could not be parsed.](event-4953.md)
|
||||
####### [Event 4954 S: Windows Firewall Group Policy settings have changed. The new settings have been applied.](event-4954.md)
|
||||
####### [Event 4956 S: Windows Firewall has changed the active profile.](event-4956.md)
|
||||
####### [Event 4957 F: Windows Firewall did not apply the following rule.](event-4957.md)
|
||||
####### [Event 4958 F: Windows Firewall did not apply the following rule because the rule referred to items not configured on this computer.](event-4958.md)
|
||||
###### [Audit Other Policy Change Events](audit-other-policy-change-events.md)
|
||||
###### [Audit Sensitive Privilege Use ](audit-sensitive-privilege-use.md)
|
||||
###### [Audit Non-Sensitive Privilege Use ](audit-non-sensitive-privilege-use.md)
|
||||
###### [Audit Other Privilege Use Events ](audit-other-privilege-use-events.md)
|
||||
####### [Event 4714 S: Encrypted data recovery policy was changed.](event-4714.md)
|
||||
####### [Event 4819 S: Central Access Policies on the machine have been changed.](event-4819.md)
|
||||
####### [Event 4826 S: Boot Configuration Data loaded.](event-4826.md)
|
||||
####### [Event 4909: The local policy settings for the TBS were changed.](event-4909.md)
|
||||
####### [Event 4910: The group policy settings for the TBS were changed.](event-4910.md)
|
||||
####### [Event 5063 S, F: A cryptographic provider operation was attempted.](event-5063.md)
|
||||
####### [Event 5064 S, F: A cryptographic context operation was attempted.](event-5064.md)
|
||||
####### [Event 5065 S, F: A cryptographic context modification was attempted.](event-5065.md)
|
||||
####### [Event 5066 S, F: A cryptographic function operation was attempted.](event-5066.md)
|
||||
####### [Event 5067 S, F: A cryptographic function modification was attempted.](event-5067.md)
|
||||
####### [Event 5068 S, F: A cryptographic function provider operation was attempted.](event-5068.md)
|
||||
####### [Event 5069 S, F: A cryptographic function property operation was attempted.](event-5069.md)
|
||||
####### [Event 5070 S, F: A cryptographic function property modification was attempted.](event-5070.md)
|
||||
####### [Event 5447 S: A Windows Filtering Platform filter has been changed.](event-5447.md)
|
||||
####### [Event 6144 S: Security policy in the group policy objects has been applied successfully.](event-6144.md)
|
||||
####### [Event 6145 F: One or more errors occurred while processing security policy in the group policy objects.](event-6145.md)
|
||||
###### [Audit Sensitive Privilege Use](audit-sensitive-privilege-use.md)
|
||||
####### [Event 4673 S, F: A privileged service was called.](event-4673.md)
|
||||
####### [Event 4674 S, F: An operation was attempted on a privileged object.](event-4674.md)
|
||||
####### [Event 4985 S: The state of a transaction has changed.](event-4985.md)
|
||||
###### [Audit Non Sensitive Privilege Use](audit-non-sensitive-privilege-use.md)
|
||||
####### [Event 4673 S, F: A privileged service was called.](event-4673.md)
|
||||
####### [Event 4674 S, F: An operation was attempted on a privileged object.](event-4674.md)
|
||||
####### [Event 4985 S: The state of a transaction has changed.](event-4985.md)
|
||||
###### [Audit Other Privilege Use Events](audit-other-privilege-use-events.md)
|
||||
####### [Event 4985 S: The state of a transaction has changed.](event-4985.md)
|
||||
###### [Audit IPsec Driver](audit-ipsec-driver.md)
|
||||
###### [Audit Other System Events](audit-other-system-events.md)
|
||||
####### [Event 5024 S: The Windows Firewall Service has started successfully.](event-5024.md)
|
||||
####### [Event 5025 S: The Windows Firewall Service has been stopped.](event-5025.md)
|
||||
####### [Event 5027 F: The Windows Firewall Service was unable to retrieve the security policy from the local storage. The service will continue enforcing the current policy.](event-5027.md)
|
||||
####### [Event 5028 F: The Windows Firewall Service was unable to parse the new security policy. The service will continue with currently enforced policy.](event-5028.md)
|
||||
####### [Event 5029 F: The Windows Firewall Service failed to initialize the driver. The service will continue to enforce the current policy.](event-5029.md)
|
||||
####### [Event 5030 F: The Windows Firewall Service failed to start.](event-5030.md)
|
||||
####### [Event 5032 F: Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network.](event-5032.md)
|
||||
####### [Event 5033 S: The Windows Firewall Driver has started successfully.](event-5033.md)
|
||||
####### [Event 5034 S: The Windows Firewall Driver was stopped.](event-5034.md)
|
||||
####### [Event 5035 F: The Windows Firewall Driver failed to start.](event-5035.md)
|
||||
####### [Event 5037 F: The Windows Firewall Driver detected critical runtime error. Terminating.](event-5037.md)
|
||||
####### [Event 5058 S, F: Key file operation.](event-5058.md)
|
||||
####### [Event 5059 S, F: Key migration operation.](event-5059.md)
|
||||
####### [Event 6400: BranchCache: Received an incorrectly formatted response while discovering availability of content.](event-6400.md)
|
||||
####### [Event 6401: BranchCache: Received invalid data from a peer. Data discarded.](event-6401.md)
|
||||
####### [Event 6402: BranchCache: The message to the hosted cache offering it data is incorrectly formatted.](event-6402.md)
|
||||
####### [Event 6403: BranchCache: The hosted cache sent an incorrectly formatted response to the client.](event-6403.md)
|
||||
####### [Event 6404: BranchCache: Hosted cache could not be authenticated using the provisioned SSL certificate.](event-6404.md)
|
||||
####### [Event 6405: BranchCache: %2 instances of event id %1 occurred.](event-6405.md)
|
||||
####### [Event 6406: %1 registered to Windows Firewall to control filtering for the following: %2.](event-6406.md)
|
||||
####### [Event 6407: 1%.](event-6407.md)
|
||||
####### [Event 6408: Registered product %1 failed and Windows Firewall is now controlling the filtering for %2.](event-6408.md)
|
||||
####### [Event 6409: BranchCache: A service connection point object could not be parsed.](event-6409.md)
|
||||
###### [Audit Security State Change](audit-security-state-change.md)
|
||||
####### [Event 4608 S: Windows is starting up.](event-4608.md)
|
||||
####### [Event 4616 S: The system time was changed.](event-4616.md)
|
||||
####### [Event 4621 S: Administrator recovered system from CrashOnAuditFail.](event-4621.md)
|
||||
###### [Audit Security System Extension](audit-security-system-extension.md)
|
||||
####### [Event 4610 S: An authentication package has been loaded by the Local Security Authority.](event-4610.md)
|
||||
####### [Event 4611 S: A trusted logon process has been registered with the Local Security Authority.](event-4611.md)
|
||||
####### [Event 4614 S: A notification package has been loaded by the Security Account Manager.](event-4614.md)
|
||||
####### [Event 4622 S: A security package has been loaded by the Local Security Authority.](event-4622.md)
|
||||
####### [Event 4697 S: A service was installed in the system.](event-4697.md)
|
||||
###### [Audit System Integrity](audit-system-integrity.md)
|
||||
####### [Event 4612 S: Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits.](event-4612.md)
|
||||
####### [Event 4615 S: Invalid use of LPC port.](event-4615.md)
|
||||
####### [Event 4618 S: A monitored security event pattern has occurred.](event-4618.md)
|
||||
####### [Event 4816 S: RPC detected an integrity violation while decrypting an incoming message.](event-4816.md)
|
||||
####### [Event 5038 F: Code integrity determined that the image hash of a file is not valid.](event-5038.md)
|
||||
####### [Event 5056 S: A cryptographic self-test was performed.](event-5056.md)
|
||||
####### [Event 5062 S: A kernel-mode cryptographic self-test was performed.](event-5062.md)
|
||||
####### [Event 5057 F: A cryptographic primitive operation failed.](event-5057.md)
|
||||
####### [Event 5060 F: Verification operation failed.](event-5060.md)
|
||||
####### [Event 5061 S, F: Cryptographic operation.](event-5061.md)
|
||||
####### [Event 6281 F: Code Integrity determined that the page hashes of an image file are not valid.](event-6281.md)
|
||||
####### [Event 6410 F: Code integrity determined that a file does not meet the security requirements to load into a process.](event-6410.md)
|
||||
###### [Other Events](other-events.md)
|
||||
####### [Event 1100 S: The event logging service has shut down.](event-1100.md)
|
||||
####### [Event 1102 S: The audit log was cleared.](event-1102.md)
|
||||
####### [Event 1104 S: The security log is now full.](event-1104.md)
|
||||
####### [Event 1105 S: Event log automatic backup.](event-1105.md)
|
||||
####### [Event 1108 S: The event logging service encountered an error while processing an incoming event published from %1.](event-1108.md)
|
||||
###### [Appendix A: Security monitoring recommendations for many audit events](appendix-a-security-monitoring-recommendations-for-many-audit-events.md)
|
||||
###### [Registry (Global Object Access Auditing) ](registry-global-object-access-auditing.md)
|
||||
###### [File System (Global Object Access Auditing) ](file-system-global-object-access-auditing.md)
|
||||
### [Security policy settings](security-policy-settings.md)
|
||||
@ -429,6 +692,115 @@
|
||||
#### [Update and manage Windows Defender in Windows 10](get-started-with-windows-defender-for-windows-10.md)
|
||||
#### [Configure Windows Defender in Windows 10](configure-windows-defender-in-windows-10.md)
|
||||
#### [Troubleshoot Windows Defender in Windows 10](troubleshoot-windows-defender-in-windows-10.md)
|
||||
### [Windows Firewall with Advanced Security](windows-firewall-with-advanced-security.md)
|
||||
#### [Isolating Windows Store Apps on Your Network](isolating-apps-on-your-network.md)
|
||||
#### [Securing End-to-End IPsec Connections by Using IKEv2 in Windows Server 2012](securing-end-to-end-ipsec-connections-by-using-ikev2.md)
|
||||
#### [Windows Firewall with Advanced Security Administration with Windows PowerShell](windows-firewall-with-advanced-security-administration-with-windows-powershell.md)
|
||||
#### [Windows Firewall with Advanced Security Design Guide](windows-firewall-with-advanced-security-design-guide.md)
|
||||
##### [Understanding the Windows Firewall with Advanced Security Design Process](understanding-the-windows-firewall-with-advanced-security-design-process.md)
|
||||
##### [Identifying Your Windows Firewall with Advanced Security Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md)
|
||||
###### [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md)
|
||||
###### [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md)
|
||||
###### [Require Encryption When Accessing Sensitive Network Resources](require-encryption-when-accessing-sensitive-network-resources.md)
|
||||
###### [Restrict Access to Only Specified Users or Computers](restrict-access-to-only-specified-users-or-devices.md)
|
||||
##### [Mapping Your Deployment Goals to a Windows Firewall with Advanced Security Design](mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md)
|
||||
###### [Basic Firewall Policy Design](basic-firewall-policy-design.md)
|
||||
###### [Domain Isolation Policy Design](domain-isolation-policy-design.md)
|
||||
###### [Server Isolation Policy Design](server-isolation-policy-design.md)
|
||||
###### [Certificate-based Isolation Policy Design](certificate-based-isolation-policy-design.md)
|
||||
##### [Evaluating Windows Firewall with Advanced Security Design Examples](evaluating-windows-firewall-with-advanced-security-design-examples.md)
|
||||
###### [Firewall Policy Design Example](firewall-policy-design-example.md)
|
||||
###### [Domain Isolation Policy Design Example](domain-isolation-policy-design-example.md)
|
||||
###### [Server Isolation Policy Design Example](server-isolation-policy-design-example.md)
|
||||
###### [Certificate-based Isolation Policy Design Example](certificate-based-isolation-policy-design-example.md)
|
||||
##### [Designing a Windows Firewall with Advanced Security Strategy](designing-a-windows-firewall-with-advanced-security-strategy.md)
|
||||
###### [Gathering the Information You Need](gathering-the-information-you-need.md)
|
||||
####### [Gathering Information about Your Current Network Infrastructure](gathering-information-about-your-current-network-infrastructure.md)
|
||||
####### [Gathering Information about Your Active Directory Deployment](gathering-information-about-your-active-directory-deployment.md)
|
||||
####### [Gathering Information about Your Computers](gathering-information-about-your-devices.md)
|
||||
####### [Gathering Other Relevant Information](gathering-other-relevant-information.md)
|
||||
###### [Determining the Trusted State of Your Computers](determining-the-trusted-state-of-your-devices.md)
|
||||
##### [Planning Your Windows Firewall with Advanced Security Design](planning-your-windows-firewall-with-advanced-security-design.md)
|
||||
###### [Planning Settings for a Basic Firewall Policy](planning-settings-for-a-basic-firewall-policy.md)
|
||||
###### [Planning Domain Isolation Zones](planning-domain-isolation-zones.md)
|
||||
####### [Exemption List](exemption-list.md)
|
||||
####### [Isolated Domain](isolated-domain.md)
|
||||
####### [Boundary Zone](boundary-zone.md)
|
||||
####### [Encryption Zone](encryption-zone.md)
|
||||
###### [Planning Server Isolation Zones](planning-server-isolation-zones.md)
|
||||
###### [Planning Certificate-based Authentication](planning-certificate-based-authentication.md)
|
||||
###### [Documenting the Zones](documenting-the-zones.md)
|
||||
###### [Planning Group Policy Deployment for Your Isolation Zones](planning-group-policy-deployment-for-your-isolation-zones.md)
|
||||
####### [Planning Isolation Groups for the Zones](planning-isolation-groups-for-the-zones.md)
|
||||
####### [Planning Network Access Groups](planning-network-access-groups.md)
|
||||
####### [Planning the GPOs](planning-the-gpos.md)
|
||||
######## [Firewall GPOs](firewall-gpos.md)
|
||||
######### [GPO_DOMISO_Firewall](gpo-domiso-firewall.md)
|
||||
######## [Isolated Domain GPOs](isolated-domain-gpos.md)
|
||||
######### [GPO_DOMISO_IsolatedDomain_Clients](gpo-domiso-isolateddomain-clients.md)
|
||||
######### [GPO_DOMISO_IsolatedDomain_Servers](gpo-domiso-isolateddomain-servers.md)
|
||||
######## [Boundary Zone GPOs](boundary-zone-gpos.md)
|
||||
######### [GPO_DOMISO_Boundary](gpo-domiso-boundary.md)
|
||||
######## [Encryption Zone GPOs](encryption-zone-gpos.md)
|
||||
######### [GPO_DOMISO_Encryption](gpo-domiso-encryption.md)
|
||||
######## [Server Isolation GPOs](server-isolation-gpos.md)
|
||||
####### [Planning GPO Deployment](planning-gpo-deployment.md)
|
||||
##### [Appendix A: Sample GPO Template Files for Settings Used in this Guide](appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md)
|
||||
#### [Windows Firewall with Advanced Security Deployment Guide](windows-firewall-with-advanced-security-deployment-guide.md)
|
||||
##### [Planning to Deploy Windows Firewall with Advanced Security](planning-to-deploy-windows-firewall-with-advanced-security.md)
|
||||
##### [Implementing Your Windows Firewall with Advanced Security Design Plan](implementing-your-windows-firewall-with-advanced-security-design-plan.md)
|
||||
##### [Checklist: Creating Group Policy Objects](checklist-creating-group-policy-objects.md)
|
||||
##### [Checklist: Implementing a Basic Firewall Policy Design](checklist-implementing-a-basic-firewall-policy-design.md)
|
||||
###### [Checklist: Configuring Basic Firewall Settings](checklist-configuring-basic-firewall-settings.md)
|
||||
###### [Checklist: Creating Inbound Firewall Rules](checklist-creating-inbound-firewall-rules.md)
|
||||
###### [Checklist: Creating Outbound Firewall Rules](checklist-creating-outbound-firewall-rules.md)
|
||||
##### [Checklist: Implementing a Domain Isolation Policy Design](checklist-implementing-a-domain-isolation-policy-design.md)
|
||||
###### [Checklist: Configuring Rules for the Isolated Domain](checklist-configuring-rules-for-the-isolated-domain.md)
|
||||
###### [Checklist: Configuring Rules for the Boundary Zone](checklist-configuring-rules-for-the-boundary-zone.md)
|
||||
###### [Checklist: Configuring Rules for the Encryption Zone](checklist-configuring-rules-for-the-encryption-zone.md)
|
||||
###### [Checklist: Configuring Rules for an Isolated Server Zone](checklist-configuring-rules-for-an-isolated-server-zone.md)
|
||||
##### [Checklist: Implementing a Standalone Server Isolation Policy Design](checklist-implementing-a-standalone-server-isolation-policy-design.md)
|
||||
###### [Checklist: Configuring Rules for Servers in a Standalone Isolated Server Zone](checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md)
|
||||
###### [Checklist: Creating Rules for Clients of a Standalone Isolated Server Zone](checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md)
|
||||
##### [Checklist: Implementing a Certificate-based Isolation Policy Design](checklist-implementing-a-certificate-based-isolation-policy-design.md)
|
||||
##### [Procedures Used in This Guide](procedures-used-in-this-guide.md)
|
||||
###### [Add Production Devices to the Membership Group for a Zone](add-production-devices-to-the-membership-group-for-a-zone.md)
|
||||
###### [Add Test Devices to the Membership Group for a Zone](add-test-devices-to-the-membership-group-for-a-zone.md)
|
||||
###### [Assign Security Group Filters to the GPO](assign-security-group-filters-to-the-gpo.md)
|
||||
###### [Change Rules from Request to Require Mode](change-rules-from-request-to-require-mode.md)
|
||||
###### [Configure Authentication Methods](configure-authentication-methods.md)
|
||||
###### [Configure Data Protection (Quick Mode) Settings](configure-data-protection-quick-mode-settings.md)
|
||||
###### [Configure Group Policy to Autoenroll and Deploy Certificates](configure-group-policy-to-autoenroll-and-deploy-certificates.md)
|
||||
###### [Configure Key Exchange (Main Mode) Settings](configure-key-exchange-main-mode-settings.md)
|
||||
###### [Configure the Rules to Require Encryption](configure-the-rules-to-require-encryption.md)
|
||||
###### [Configure the Windows Firewall Log](configure-the-windows-firewall-log.md)
|
||||
###### [Configure the Workstation Authentication Certificate Template](configure-the-workstation-authentication-certificate-template.md)
|
||||
###### [Configure Windows Firewall to Suppress Notifications When a Program Is Blocked](configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md)
|
||||
###### [Confirm That Certificates Are Deployed Correctly](confirm-that-certificates-are-deployed-correctly.md)
|
||||
###### [Copy a GPO to Create a New GPO](copy-a-gpo-to-create-a-new-gpo.md)
|
||||
###### [Create a Group Account in Active Directory](create-a-group-account-in-active-directory.md)
|
||||
###### [Create a Group Policy Object](create-a-group-policy-object.md)
|
||||
###### [Create an Authentication Exemption List Rule](create-an-authentication-exemption-list-rule.md)
|
||||
###### [Create an Authentication Request Rule](create-an-authentication-request-rule.md)
|
||||
###### [Create an Inbound ICMP Rule](create-an-inbound-icmp-rule.md)
|
||||
###### [Create an Inbound Port Rule](create-an-inbound-port-rule.md)
|
||||
###### [Create an Inbound Program or Service Rule](create-an-inbound-program-or-service-rule.md)
|
||||
###### [Create an Outbound Port Rule](create-an-outbound-port-rule.md)
|
||||
###### [Create an Outbound Program or Service Rule](create-an-outbound-program-or-service-rule.md)
|
||||
###### [Create Inbound Rules to Support RPC](create-inbound-rules-to-support-rpc.md)
|
||||
###### [Create WMI Filters for the GPO](create-wmi-filters-for-the-gpo.md)
|
||||
###### [Enable Predefined Inbound Rules](enable-predefined-inbound-rules.md)
|
||||
###### [Enable Predefined Outbound Rules](enable-predefined-outbound-rules.md)
|
||||
###### [Exempt ICMP from Authentication](exempt-icmp-from-authentication.md)
|
||||
###### [Link the GPO to the Domain](link-the-gpo-to-the-domain.md)
|
||||
###### [Modify GPO Filters to Apply to a Different Zone or Version of Windows](modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md)
|
||||
###### [Open the Group Policy Management Console to IP Security Policies](open-the-group-policy-management-console-to-ip-security-policies.md)
|
||||
###### [Open the Group Policy Management Console to Windows Firewall](open-the-group-policy-management-console-to-windows-firewall.md)
|
||||
###### [Open the Group Policy Management Console to Windows Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md)
|
||||
###### [Open Windows Firewall with Advanced Security](open-windows-firewall-with-advanced-security.md)
|
||||
###### [Restrict Server Access to Members of a Group Only](restrict-server-access-to-members-of-a-group-only.md)
|
||||
###### [Turn on Windows Firewall and Configure Default Behavior](turn-on-windows-firewall-and-configure-default-behavior.md)
|
||||
###### [Verify That Network Traffic Is Authenticated](verify-that-network-traffic-is-authenticated.md)
|
||||
## [Enterprise security guides](windows-10-enterprise-security-guides.md)
|
||||
### [Control the health of Windows 10-based devices](protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md)
|
||||
### [Device Guard deployment guide](device-guard-deployment-guide.md)
|
||||
|
||||
Reference in New Issue
Block a user