What does 4625 mean?
Type a Windows security event ID and get its meaning, how Microsoft rates it for Active Directory monitoring, and which pre-Vista event it replaced. For the events an analyst actually meets, there is also a note on what a benign instance looks like and what makes one worth chasing.
Corrections welcome — see our editorial policy.
4625), a pre-Vista legacy ID (529), a keyword (lockout), or a pasted log line. Covers the Security-log events in Microsoft’s Active Directory monitoring guidance — not the whole Windows event catalogue.The events Microsoft rates above Medium
Out of the whole monitoring list, only these are rated higher than Medium. Most of them are rare by design — several only appear at all if someone configured them — which is exactly why they are worth knowing on sight.
| Event | Legacy | Rating | Meaning |
|---|---|---|---|
| 1102 | 517 | Medium to High | The audit log was cleared. |
| 4618 | — | High | A monitored security event pattern has occurred. |
| 4649 | — | High | A replay attack was detected. |
| 4719 | 612 | High | System audit policy was changed. |
| 4765 | — | High | SID History was added to an account. |
| 4766 | — | High | An attempt to add SID History to an account failed. |
| 4794 | — | High | An attempt was made to set the Directory Services Restore Mode. |
| 4897 | 801 | High | Role separation enabled. |
| 4964 | — | High | Special groups have been assigned to a new logon. |
| 5124 | — | High | A security setting was updated on the OCSP Responder Service. |
Why the rating is not a severity
The rating shown against each event is Microsoft’s, and it comes from a guide about monitoring Active Directory. That context is the whole story. In it, event 4625 — a failed logon — is rated Low, and so are 4624, 4688 and 4720. Not because a failed logon is unimportant, but because a domain controller writes thousands a day and you cannot alert on all of them.
Read as a severity score by someone triaging a single alert, that is exactly backwards. A failed logon in front of you may be the most important line in the investigation. So the rating is labelled as what it is, and where it would mislead, our own note says so directly rather than leaving you to notice.
The renumbering, and why old runbooks still matter
Windows Server 2008 and Vista renumbered the security events. Most of the old identifiers moved by exactly 4096 — 528 became 4624, 592 became 4688, 624 became 4720 — which is why the mapping is often described as simply adding 4096.
It is not that tidy. Of the legacy-to-current pairs published in the source table, most follow the +4096 rule and a substantial minority do not. Audit-log-cleared went from 517 to 1102, landing in a different range entirely. Several others are off by a few. If you are reading a runbook written before 2008, or a detection rule someone ported without checking, arithmetic is not a safe substitute for the table — which is why the legacy IDs are searchable here directly.
One published event carries two meanings: 4764 appears twice in the source, with two different legacy IDs behind it. Both are shown rather than one being quietly picked.
What this covers
The corpus is the Security-log event list from Microsoft’s Active Directory monitoring guidance. That is a deliberate scope, and it has edges worth stating plainly:
- It is Security-log focused. System-log events are largely absent —
7045, service installation, is a common example that will not resolve here. - It is one line per event, not a field reference. You get what the event records, not a breakdown of every field within it. Microsoft’s per-event documentation used to cover that and is no longer published in a form we can carry.
- The analyst notes cover a subset. Every event rated above Medium has one, plus the authentication, account-management and process-creation events that make up most of the day-to-day. The rest show the published summary alone.
For working through a log full of addresses rather than event IDs, Log IP Triage ranks which ones deserve attention first. For a single indicator, IOC Enrichment assembles the full picture.
Where this data comes from
Event IDs, criticality ratings and summaries are from Appendix L: Events to monitor, published by Microsoft, © Microsoft Corporation. Licensed under Creative Commons Attribution 4.0 International. The material is provided as-is and as-available, without warranties of any kind; see the licence for the full disclaimer.
Modified: the published table has been reshaped into a searchable index and its legacy-ID column expanded from comma and range notation into individual identifiers. No summary text was altered. The analyst notes are Network Lookup’s own work and are not part of the licensed material.