| Sr no | Event ID 2003 Server | Event ID 2008 Server | Event Type |
| 1 | 528 | 4624 | Local User logon |
| 2 | 6008 | 6008 | Unexpected Shutdown |
| 3 | 6009 | 6009 | Logged During every boot |
| 4 | 6006 | 6006 | Clean Shutdown |
| 5 | 624 | 4720 | Local account created |
| 6 | 630 | 4726 | Local account deleted |
| 7 | 7036 | 7036 | DHCP Server Service Start |
| 8 | 7035 | 7035 | DHCP Server Service Stop |
| 9 | 3 | 3 | DNS Server Shutdown |
| 10 | 2 | 2 | DNS Server Start |
| 11 |
|
4777 | The Domain Controller failed to validate the credential |
| 12 | 576 | 4672 | Special privilages assigned to new logon |
| 13 | 578 | 4674 | An operation was attempted on a privileged object |
| 14 | 520 | 4616 | The system time was changed |
| 15 | 608 | 4704 | A user right was assigned |
| 16 | 609 | 4705 | A user Rights was removed |
| 17 | 567 | 4657 | A registry value was modified |
| 18 | 564 | 4660 | An object was deleted |
| 19 | 643 | 4739 | Domain policy was changed |
| 20 | 644 | 4740 | A user account was locked out |
| 21 | 685 | 4781 | The name of the account was changed |
原文：http://www.cnblogs.com/IvanChen/p/4494764.html