Windows Event IDs Every IT Technician Should Know

Windows logs almost everything that happens on a system — logons, service failures, policy changes, unexpected reboots — into Event Viewer, organised by log (Security, System, Application and others) and identified by a numeric Event ID. Learning to recognise the handful of IDs that come up constantly in support work turns Event Viewer from a wall of noise into a genuinely fast diagnostic tool.

This guide covers the security and system event IDs technicians run into most often, with what each one actually means and how to use it during troubleshooting. Look up any ID instantly with the Event ID Lookup tool.

Open Event Viewer (eventvwr.msc) and expand Windows Logs. The three logs you'll use most:

• Security — logon attempts, account changes, privilege use. Requires audit policy to be enabled to populate fully.
• System — service state changes, driver issues, shutdowns and restarts, hardware events.
• Application — events raised by installed software rather than the OS itself.

Use Filter Current Log to narrow by Event ID and time range — filtering by a specific ID and a tight time window around when a user reports a problem is far faster than scrolling. When correlating an issue, work outward from the exact timestamp the user reports, checking Security and System logs for that same window.

• 4624 — An account was successfully logged on. Confirms a successful logon; check the Logon Type field to see whether it was interactive, network, RDP or a service logon.
• 4625 — An account failed to log on. The single most useful ID for chasing lockouts and brute-force attempts. Check the Failure Reason and the source workstation/IP.
• 4648 — A logon was attempted using explicit credentials. Typically appears when a user runs something as a different account (runas), which is worth investigating if unexpected.
• 4672 — Special privileges assigned to new logon. Fires when an account with administrative-level rights logs on — useful for auditing admin activity.
• 4720 — A user account was created. Every new account creation, useful for spotting unauthorised accounts.
• 4726 — A user account was deleted.
• 4740 — A user account was locked out. Pair this with nearby 4625 events to find the device repeatedly sending bad credentials and triggering the lockout.

• 6005 — The Event log service was started. Logged on every boot; a useful marker for when a machine came back up.
• 6006 — The Event log service was stopped. Logged on a clean shutdown.
• 6008 — The previous system shutdown was unexpected. A dirty shutdown was detected — worth checking power, hardware or driver issues.
• 41 (Kernel-Power) — The system has rebooted without cleanly shutting down first. Often points to a power loss, a hard hang, or a driver/hardware fault; if it recurs, investigate power supply, overheating and recent driver changes.
• 7034 — A service terminated unexpectedly. Identifies which service crashed — a good starting point for investigating repeated application or service instability.
• 1074 — The process X initiated the restart/shutdown of computer Y. Shows exactly what triggered a shutdown or restart and who (or what process) requested it — useful when a reboot wasn't expected.

Investigating an account lockout: filter Security log for Event ID 4740, note the timestamp and calling computer, then filter for Event ID 4625 shortly before that timestamp to find the source of the failed logon attempts (often a cached credential on a phone, mapped drive or scheduled task using an old password).

Investigating an unexpected reboot: filter System log for Event ID 41 and 6008. If either appears repeatedly without a corresponding planned 1074 event, treat it as a hardware, power or driver issue rather than a user-initiated restart.

Investigating a crashed service: filter System log for Event ID 7034, identify the service name, then check Application log around the same timestamp for a more detailed error from that service itself.