Source: Security
Message dll: C:\WIN2003\System32\MsAuditE.dll
Number of events: 214

ID: 512 Description: Windows is starting up.

ID: 513 Description: Windows is shutting down.
All logon sessions will be terminated by this shutdown.

ID: 514 Description: An authentication package has been loaded by the Local Security Authority.
This authentication package will be used to authenticate logon attempts.

Authentication Package Name:	%1

ID: 515 Description: A trusted logon process has registered with the Local Security Authority.
This logon process will be trusted to submit logon requests.


Logon Process Name:	%1

ID: 516 Description: Internal resources allocated for the queuing of audit messages have been exhausted,
leading to the loss of some audits.

	Number of audit messages discarded:	%1

ID: 517 Description: The audit log was cleared

	Primary User Name:	%1
	Primary Domain:	%2
	Primary Logon ID:	%3
	Client User Name:	%4
	Client Domain:	%5
	Client Logon ID:	%6

ID: 518 Description: An notification package has been loaded by the Security Account Manager.
This package will be notified of any account or password changes.

Notification Package Name:	%1

ID: 519 Description: Invalid use of LPC port.
	Process ID: %1
	Image File Name: %2
	Primary User Name:	%3
	Primary Domain:	%4
	Primary Logon ID:	%5
	Client User Name:	%6
	Client Domain:	%7
	Client Logon ID:	%8
	Invalid use: %9
	Server Port Name:	%10

ID: 520 Description: The system time was changed.
Process ID:		%1
Process Name:		%2
Primary User Name:	%3
Primary Domain:		%4
Primary Logon ID:		%5
Client User Name:		%6
Client Domain:		%7
Client Logon ID:		%8
Previous Time:		%10 %9
New Time:		%12 %11

ID: 521 Description: Unable to log events to security log:
	Status code:		%1
	Value of CrashOnAuditFail:	%2

ID: 522 Description: The audit collection system has encountered an error.
	Component:	%1
	Version:	%2
	Status code:	%3

ID: 523 Description: The security log is now %1 percent full.

ID: 524 Description: Event log auto-backup
	Log:	%1
	File:	%2
	Status:	%3

ID: 528 Description: Successful Logon:
	User Name:	%1
	Domain:		%2
	Logon ID:		%3
	Logon Type:	%4
	Logon Process:	%5
	Authentication Package:	%6
	Workstation Name:	%7
	Logon GUID:	%8
	Caller User Name:	%9
	Caller Domain:	%10
	Caller Logon ID:	%11
	Caller Process ID: %12
	Transited Services: %13
	Source Network Address:	%14
	Source Port:	%15

ID: 529 Description: Logon Failure:
	Reason:		Unknown user name or bad password
	User Name:	%1
	Domain:		%2
	Logon Type:	%3
	Logon Process:	%4
	Authentication Package:	%5
	Workstation Name:	%6
	Caller User Name:	%7
	Caller Domain:	%8
	Caller Logon ID:	%9
	Caller Process ID:	%10
	Transited Services:	%11
	Source Network Address:	%12
	Source Port:	%13

ID: 530 Description: Logon Failure:
	Reason:		Account logon time restriction violation
	User Name:	%1
	Domain:		%2
	Logon Type:	%3
	Logon Process:	%4
	Authentication Package:	%5
	Workstation Name:	%6
	Caller User Name:	%7
	Caller Domain:	%8
	Caller Logon ID:	%9
	Caller Process ID:	%10
	Transited Services:	%11
	Source Network Address:	%12
	Source Port:	%13

ID: 531 Description: Logon Failure:
	Reason:		Account currently disabled
	User Name:	%1
	Domain:		%2
	Logon Type:	%3
	Logon Process:	%4
	Authentication Package:	%5
	Workstation Name:	%6
	Caller User Name:	%7
	Caller Domain:	%8
	Caller Logon ID:	%9
	Caller Process ID:	%10
	Transited Services:	%11
	Source Network Address:	%12
	Source Port:	%13

ID: 532 Description: Logon Failure:
	Reason:		The specified user account has expired
	User Name:	%1
	Domain:		%2
	Logon Type:	%3
	Logon Process:	%4
	Authentication Package:	%5
	Workstation Name:	%6
	Caller User Name:	%7
	Caller Domain:	%8
	Caller Logon ID:	%9
	Caller Process ID:	%10
	Transited Services:	%11
	Source Network Address:	%12
	Source Port:	%13

ID: 533 Description: Logon Failure:
	Reason:		User not allowed to logon at this computer
	User Name:	%1
	Domain:		%2
	Logon Type:	%3
	Logon Process:	%4
	Authentication Package:	%5
	Workstation Name:	%6
	Caller User Name:	%7
	Caller Domain:	%8
	Caller Logon ID:	%9
	Caller Process ID:	%10
	Transited Services:	%11
	Source Network Address:	%12
	Source Port:	%13

ID: 534 Description: Logon Failure:
	Reason:	The user has not been granted the requested
		logon type at this machine
	User Name:	%1
	Domain:		%2
	Logon Type:	%3
	Logon Process:	%4
	Authentication Package:	%5
	Workstation Name:	%6
	Caller User Name:	%7
	Caller Domain:	%8
	Caller Logon ID:	%9
	Caller Process ID:	%10
	Transited Services:	%11
	Source Network Address:	%12
	Source Port:	%13

ID: 535 Description: Logon Failure:
	Reason:		The specified account's password has expired
	User Name:	%1
	Domain:		%2
	Logon Type:	%3
	Logon Process:	%4
	Authentication Package:	%5
	Workstation Name:	%6
	Caller User Name:	%7
	Caller Domain:	%8
	Caller Logon ID:	%9
	Caller Process ID:	%10
	Transited Services:	%11
	Source Network Address:	%12
	Source Port:	%13

ID: 536 Description: Logon Failure:
	Reason:		The NetLogon component is not active
	User Name:	%1
	Domain:		%2
	Logon Type:	%3
	Logon Process:	%4
	Authentication Package:	%5
	Workstation Name:	%6
	Caller User Name:	%7
	Caller Domain:	%8
	Caller Logon ID:	%9
	Caller Process ID:	%10
	Transited Services:	%11
	Source Network Address:	%12
	Source Port:	%13

ID: 537 Description: Logon Failure:
	Reason:		An error occurred during logon
	User Name:	%1
	Domain:		%2
	Logon Type:	%3
	Logon Process:	%4
	Authentication Package:	%5
	Workstation Name:	%6
	Status code:	%7
	Substatus code:	%8
	Caller User Name:	%9
	Caller Domain:	%10
	Caller Logon ID:	%11
	Caller Process ID:	%12
	Transited Services:	%13
	Source Network Address:	%14
	Source Port:	%15

ID: 538 Description: User Logoff:
	User Name:	%1
	Domain:		%2
	Logon ID:		%3
	Logon Type:	%4

ID: 539 Description: Logon Failure:
	Reason:		Account locked out
	User Name:	%1
	Domain:	%2
	Logon Type:	%3
	Logon Process:	%4
	Authentication Package:	%5
	Workstation Name:	%6
	Caller User Name:	%7
	Caller Domain:	%8
	Caller Logon ID:	%9
	Caller Process ID: %10
	Transited Services: %11
	Source Network Address:	%12
	Source Port:	%13

ID: 540 Description: Successful Network Logon:
	User Name:	%1
	Domain:		%2
	Logon ID:		%3
	Logon Type:	%4
	Logon Process:	%5
	Authentication Package:	%6
	Workstation Name:	%7
	Logon GUID:	%8
	Caller User Name:	%9
	Caller Domain:	%10
	Caller Logon ID:	%11
	Caller Process ID: %12
	Transited Services: %13
	Source Network Address:	%14
	Source Port:	%15

ID: 541 Description: IKE security association established.
Mode: %1
Peer Identity: %2
Filter: %3
Parameters: %4

ID: 542 Description: IKE security association ended.
Mode: Data Protection (Quick mode)
Filter: %1
Inbound SPI: %2
Outbound SPI: %3

ID: 543 Description: IKE security association ended.
Mode: Key Exchange (Main mode)
Filter: %1

ID: 544 Description: IKE security association establishment failed because peer could not authenticate.
The certificate trust could not be established.
Peer Identity: %1
Filter: %2

ID: 545 Description: IKE peer authentication failed.
Peer Identity: %1
Filter: %2

ID: 546 Description: IKE security association establishment failed because peer
sent invalid proposal.
Mode: %1
Filter: %2
Attribute: %3
Expected value: %4
Received value: %5

ID: 547 Description: IKE security association negotiation failed.
Mode: %1
Filter: %2
Peer Identity: %3 
Failure Point: %4
Failure Reason: %5
Extra Status: %6

ID: 548 Description: Logon Failure:
	Reason:		Domain sid inconsistent
	User Name:	%1
	Domain:		%2
	Logon Type:	%3
	Logon Process:	%4
	Authentication Package:	%5
	Workstation Name:	%6
	Transited Services:	%7

ID: 549 Description: Logon Failure:
	Reason: 	All sids were filtered out
	User Name:	%1
	Domain:	%2
	Logon Type:	%3
	Logon Process:	%4
	Authentication Package	: %5
	Workstation Name:	%6

ID: 550 Description: %1

ID: 551 Description: User initiated logoff:
	User Name:	%1
	Domain:		%2
	Logon ID:		%3

ID: 552 Description: Logon attempt using explicit credentials:
Logged on user:
	User Name:	%1
	Domain:		%2
	Logon ID:		%3
	Logon GUID:	%4
User whose credentials were used:
	Target User Name:	%5
	Target Domain:	%6
	Target Logon GUID: %7
Target Server Name:	%8
Target Server Info:	%9
Caller Process ID:	%10
Source Network Address:	%11
Source Port:	%12

ID: 553 Description: 	User Name:	%1
	Domain:	%	%2
	Request Type:	%3
	Logon Process:	%4
	Authentication Package:	%5
	Workstation Name:	%6
	Caller User Name:	%7
	Caller Domain:	%8
	Caller Logon ID:	%9
	Caller Process ID: %10
	Transited Services: %11

ID: 560 Description: Object Open:
	Object Server:	%1
	Object Type:	%2
	Object Name:	%3
	Handle ID:	%4
	Operation ID:	{%5,%6}
	Process ID:	%7
	Image File Name:	%8
	Primary User Name:	%9
	Primary Domain:	%10
	Primary Logon ID:	%11
	Client User Name:	%12
	Client Domain:	%13
	Client Logon ID:	%14
	Accesses:	%15
	Privileges:	%16
	Restricted Sid Count:	%17
	Access Mask:	%18

ID: 562 Description: Handle Closed:
	Object Server:	%1
	Handle ID:	%2
	Process ID:	%3
	Image File Name:	%4

ID: 563 Description: Object Open for Delete:
	Object Server:	%1
	Object Type:	%2
	Object Name:	%3
	Handle ID:	%4
	Operation ID:	{%5,%6}
	Process ID:	%7
	Primary User Name:	%8
	Primary Domain:	%9
	Primary Logon ID:	%10
	Client User Name:	%11
	Client Domain:	%12
	Client Logon ID:	%13
	Accesses:		%14
	Privileges:		%15
	Access Mask:	%16

ID: 564 Description: Object Deleted:
	Object Server:	%1
	Handle ID:	%2
	Process ID:	%3
	Image File Name:	%4

ID: 565 Description: Object Open:
	Object Server:	%1
	Object Type:	%2
	Object Name:	%3
	Handle ID:	%4
	Operation ID:	{%5,%6}
	Process ID:	%7
	Process Name:	%8
	Primary User Name:	%9
	Primary Domain:	%10
	Primary Logon ID:	%11
	Client User Name:	%12
	Client Domain:	%13
	Client Logon ID:	%14
	Accesses:	%15
	Privileges:	%16
	Properties:%17
	Access Mask:	%18

ID: 566 Description: Object Operation:
	Object Server:	%1
	Operation Type:	%2
	Object Type:	%3
	Object Name:	%4
	Handle ID:	%5
	Primary User Name:	%6
	Primary Domain:	%7
	Primary Logon ID:	%8
	Client User Name:	%9
	Client Domain:	%10
	Client Logon ID:	%11
	Accesses:	%12
	Properties:	%13
	Additional Info:	%14
	Additional Info2:	%15
	Access Mask:	%16

ID: 567 Description: Object Access Attempt:
	Object Server:	%1
	Handle ID:	%2
	Object Type:	%3
	Process ID:	%4
	Image File Name:	%5
	Accesses:	%6
	Access Mask:	%7

ID: 568 Description: Hard link creation attempt:
	Primary User Name:	%1
	Primary Domain:	%2
	Primary Logon ID:	%3
	File Name:	%4
	Link Name:	%5

ID: 569 Description: Application client context creation attempt:
	Application Name:	%1
	Application Instance ID:	%2
	Client Name:	%3
	Client Domain:	%4
	Client Context ID:	%5
	Status:	%6

ID: 570 Description: Application operation attempt:
	Application Name:	%1
	Application Instance ID:	%2
	Object Name:	%3
	Scope Names:	%4
	Client Name:	%5
	Client Domain:	%6
	Client Context ID:	%7
	Role:	%8
	Groups:	%9
	Operation Name:	%10 (%11)

ID: 571 Description: Application client context deletion:
	Application Name:	%1
	Application Instance ID:	%2
	Client Name:	%3
	Client Domain:	%4
	Client Context ID:	%5

ID: 572 Description: Application Initialized
	Application Name:	%1
	Application Instance ID:	%2
	Client Name:	%3
	Client Domain:	%4
	Client ID:	%5
	Policy Store URL:	%6

ID: 573 Description: Application-specific security event.
	Event Source:	%1
	Event ID:	%2
		%3
		%4
		%5
		%6
		%7
		%8
		%9
		%10
		%11
		%12
		%13
		%14
		%15
		%16
		%17
		%18
		%19
		%20
		%21
		%22
		%23
		%24
		%25
		%26
		%27

ID: 576 Description: Special privileges assigned to new logon:
	User Name:	%1
	Domain:		%2
	Logon ID:		%3
	Privileges:	%4

ID: 577 Description: Privileged Service Called:
	Server:		%1
	Service:		%2
	Primary User Name:	%3
	Primary Domain:	%4
	Primary Logon ID:	%5
	Client User Name:	%6
	Client Domain:	%7
	Client Logon ID:	%8
	Privileges:	%9

ID: 578 Description: Privileged object operation:
	Object Server:	%1
	Object Handle:	%2
	Process ID:	%3
	Primary User Name:	%4
	Primary Domain:	%5
	Primary Logon ID:	%6
	Client User Name:	%7
	Client Domain:	%8
	Client Logon ID:	%9
	Privileges:	%10

ID: 592 Description: A new process has been created:
	New Process ID:	%1
	Image File Name:	%2
	Creator Process ID:	%3
	User Name:	%4
	Domain:		%5
	Logon ID:		%6

ID: 593 Description: A process has exited:
	Process ID:	%1
	Image File Name:	%2
	User Name:	%3
	Domain:		%4
	Logon ID:		%5

ID: 594 Description: A handle to an object has been duplicated:
	Source Handle ID:	%1
	Source Process ID:	%2
	Target Handle ID:	%3
	Target Process ID:	%4

ID: 595 Description: Indirect access to an object has been obtained:
	Object Type:	%1
	Object Name:	%2
	Process ID:	%3
	Primary User Name:	%4
	Primary Domain:	%5
	Primary Logon ID:	%6
	Client User Name:	%7
	Client Domain:	%8
	Client Logon ID:	%9
	Accesses:	%10
	Access Mask:	%11

ID: 596 Description: Backup of data protection master key.

	Key Identifier:		%1
	Recovery Server:		%2
	Recovery Key ID:		%3
	Failure Reason:		%4

ID: 597 Description: Recovery of data protection master key.

	Key Identifier:		%1
	Recovery Reason:		%3
	Recovery Server:		%2
	Recovery Key ID:		%4
	Failure Reason:		%5

ID: 598 Description: Protection of auditable protected data.

	Data Description:		%2
	Key Identifier:		%1
	Protected Data Flags:	%3
	Protection Algorithms:	%4
	Failure Reason:		%5

ID: 599 Description: Unprotection of auditable protected data.

	Data Description:		%2
	Key Identifier:		%1
	Protected Data Flags:	%3
	Protection Algorithms:	%4
	Failure Reason:		%5

ID: 600 Description: A process was assigned a primary token.
Assigning Process Information:
	Process ID:	%1
	Image File Name:	%2
	Primary User Name:	%3
	Primary Domain:	%4
	Primary Logon ID:	%5
New Process Information:
	Process ID:	%6
	Image File Name:	%7
	Target User Name:	%8
	Target Domain:	%9
	Target Logon ID:	%10

ID: 601 Description: Attempt to install service:
	Service Name:	%1
	Service File Name:	%2
	Service Type:	%3
	Service Start Type:	%4
	Service Account:	%5
By:
	User Name:	%6
	Domain:		%7
	Logon ID:		%8

ID: 602 Description: Scheduled Task created:
	File Name:	%1
	Command:	%2
	Triggers:		%3
	Time:		%4 %5
	Flags:		%6
	Target User:	%7
By:
	User:		%8
	Domain:		%9
	Logon ID:		%10

ID: 608 Description: User Right Assigned:
	User Right:	%1
	Assigned To:	%2
	Assigned By:
	  User Name:	%3
	  Domain:		%4
	  Logon ID:	%5

ID: 609 Description: User Right Removed:
	User Right:	%1
	Removed From:	%2
	Removed By:
	  User Name:	%3
	  Domain:		%4
	  Logon ID:	%5

ID: 610 Description: New Trusted Domain:
	Domain Name:	%1
	Domain ID:	%2
	Established By:
	  User Name:	%3
	  Domain:		%4
	  Logon ID:	%5
	Trust Type:	%6
	Trust Direction:	%7
	Trust Attributes:	%8
	SID Filtering:	%9

ID: 611 Description: Trusted Domain Removed:
	Domain Name:	%1
	Domain ID:	%2
	Removed By:
	  User Name:	%3
	  Domain:		%4
	  Logon ID:	%5

ID: 612 Description: Audit Policy Change:
New Policy:
	Success	Failure
	    %3	    %4	Logon/Logoff
	    %5	    %6	Object Access
	    %7	    %8	Privilege Use
	    %13	    %14	Account Management
	    %11	    %12	Policy Change
	    %1	    %2	System
	    %9	    %10	Detailed Tracking
	    %15	    %16	Directory Service Access
	    %17	    %18	Account Logon
Changed By:
	  User Name:	%19
	  Domain Name:	%20
	  Logon ID:	%21

ID: 613 Description: IPSec Services started: 	%1
Policy Source: 	%2
%3

ID: 614 Description: IPSec Services disabled: 	%1
%2

ID: 615 Description: IPSec Services: 	%1

ID: 616 Description: IPSec Services encountered a potentially serious failure.
%1

ID: 617 Description: Kerberos Policy Changed:
Changed By:
	  User Name:	%1
	  Domain Name:	%2
	  Logon ID:	%3
Changes made:
('--' means no changes, otherwise each change is shown as:
<ParameterName>: <new value> (<old value>))
%4

ID: 618 Description: Encrypted Data Recovery Policy Changed:
Changed By:
	  User Name:	%1
	  Domain Name:	%2
	  Logon ID:	%3
Changes made:
('--' means no changes, otherwise each change is shown as:
<ParameterName>: <new value> (<old value>))
%4

ID: 620 Description: Trusted Domain Information Modified:
	Domain Name:	%1
	Domain ID:	%2
	Modified By:
	  User Name:	%3
	  Domain:		%4
	  Logon ID:	%5
	Trust Type:	%6
	Trust Direction:	%7
	Trust Attributes:	%8
	SID Filtering:	%9

ID: 621 Description: System Security Access Granted:
	Access Granted:	%4
	Account Modified:	%5
	Assigned By:
	  User Name:	%1
	  Domain:		%2
	  Logon ID:	%3

ID: 622 Description: System Security Access Removed:
	Access Removed:	%4
	Account Modified:	%5
	Removed By:
	  User Name:	%1
	  Domain:		%2
	  Logon ID:	%3

ID: 624 Description: User Account Created:
	New Account Name:	%1
	New Domain:	%2
	New Account ID:	%3
	Caller User Name:	%4
	Caller Domain:	%5
	Caller Logon ID:	%6
	Privileges		%7
Attributes:
	Sam Account Name:	%8
	Display Name:	%9
	User Principal Name:	%10
	Home Directory:	%11
	Home Drive:	%12
	Script Path:	%13
	Profile Path:	%14
	User Workstations:	%15
	Password Last Set:	%16
	Account Expires:	%17
	Primary Group ID:	%18
	AllowedToDelegateTo:	%19
	Old UAC Value:	%20
	New UAC Value:	%21
	User Account Control:	%22
	User Parameters:	%23
	Sid History:	%24
	Logon Hours:	%25

ID: 626 Description: User Account Enabled:
	Target Account Name:	%1
	Target Domain:	%2
	Target Account ID:	%3
	Caller User Name:	%4
	Caller Domain:	%5
	Caller Logon ID:	%6

ID: 627 Description: Change Password Attempt:
	Target Account Name:	%1
	Target Domain:	%2
	Target Account ID:	%3
	Caller User Name:	%4
	Caller Domain:	%5
	Caller Logon ID:	%6
	Privileges:	%7

ID: 628 Description: User Account password set:
	Target Account Name:	%1
	Target Domain:	%2
	Target Account ID:	%3
	Caller User Name:	%4
	Caller Domain:	%5
	Caller Logon ID:	%6

ID: 629 Description: User Account Disabled:
	Target Account Name:	%1
	Target Domain:	%2
	Target Account ID:	%3
	Caller User Name:	%4
	Caller Domain:	%5
	Caller Logon ID:	%6

ID: 630 Description: User Account Deleted:
	Target Account Name:	%1
	Target Domain:	%2
	Target Account ID:	%3
	Caller User Name:	%4
	Caller Domain:	%5
	Caller Logon ID:	%6
	Privileges:	%7

ID: 631 Description: Security Enabled Global Group Created:
	New Account Name:	%1
	New Domain:	%2
	New Account ID:	%3
	Caller User Name:	%4
	Caller Domain:	%5
	Caller Logon ID:	%6
	Privileges:	%7
Attributes:
	Sam Account Name:	%8
	Sid History:	%9

ID: 632 Description: Security Enabled Global Group Member Added:
	Member Name:	%1
	Member ID:	%2
	Target Account Name:	%3
	Target Domain:	%4
	Target Account ID:	%5
	Caller User Name:	%6
	Caller Domain:	%7
	Caller Logon ID:	%8
	Privileges:	%9

ID: 633 Description: Security Enabled Global Group Member Removed:
	Member Name:	%1
	Member ID:	%2
	Target Account Name:	%3
	Target Domain:	%4
	Target Account ID:	%5
	Caller User Name:	%6
	Caller Domain:	%7
	Caller Logon ID:	%8
	Privileges:	%9

ID: 634 Description: Security Enabled Global Group Deleted:
	Target Account Name:	%1
	Target Domain:	%2
	Target Account ID:	%3
	Caller User Name:	%4
	Caller Domain:	%5
	Caller Logon ID:	%6
	Privileges:	%7

ID: 635 Description: Security Enabled Local Group Created:
	New Account Name:	%1
	New Domain:	%2
	New Account ID:	%3
	Caller User Name:	%4
	Caller Domain:	%5
	Caller Logon ID:	%6
	Privileges:	%7
Attributes:
	Sam Account Name:	%8
	Sid History:	%9

ID: 636 Description: Security Enabled Local Group Member Added:
	Member Name:	%1
	Member ID:	%2
	Target Account Name:	%3
	Target Domain:	%4
	Target Account ID:	%5
	Caller User Name:	%6
	Caller Domain:	%7
	Caller Logon ID:	%8
	Privileges:	%9

ID: 637 Description: Security Enabled Local Group Member Removed:
	Member Name:	%1
	Member ID:	%2
	Target Account Name:	%3
	Target Domain:	%4
	Target Account ID:	%5
	Caller User Name:	%6
	Caller Domain:	%7
	Caller Logon ID:	%8
	Privileges:	%9

ID: 638 Description: Security Enabled Local Group Deleted:
	Target Account Name:	%1
	Target Domain:	%2
	Target Account ID:	%3
	Caller User Name:	%4
	Caller Domain:	%5
	Caller Logon ID:	%6
	Privileges:	%7

ID: 639 Description: Security Enabled Local Group Changed:
	Target Account Name:	%1
	Target Domain:	%2
	Target Account ID:	%3
	Caller User Name:	%4
	Caller Domain:	%5
	Caller Logon ID:	%6
	Privileges:	%7
Changed Attributes:
	Sam Account Name:	%8
	Sid History:	%9

ID: 640 Description: General Account Database Change:
	Type of change:	%1
	Object Type:	%2
	Object Name:	%3
	Object ID:	%4
	Caller User Name:	%5
	Caller Domain:	%6
	Caller Logon ID:	%7

ID: 641 Description: Security Enabled Global Group Changed:
	Target Account Name:	%1
	Target Domain:	%2
	Target Account ID:	%3
	Caller User Name:	%4
	Caller Domain:	%5
	Caller Logon ID:	%6
	Privileges:	%7
Changed Attributes:
	Sam Account Name:	%8
	Sid History:	%9

ID: 642 Description: User Account Changed:
	Target Account Name:	%2
	Target Domain:	%3
	Target Account ID:	%4
	Caller User Name:	%5
	Caller Domain:	%6
	Caller Logon ID:	%7
	Privileges:	%8
Changed Attributes:
	Sam Account Name:	%9
	Display Name:	%10
	User Principal Name:	%11
	Home Directory:	%12
	Home Drive:	%13
	Script Path:	%14
	Profile Path:	%15
	User Workstations:	%16
	Password Last Set:	%17
	Account Expires:	%18
	Primary Group ID:	%19
	AllowedToDelegateTo:	%20
	Old UAC Value:	%21
	New UAC Value:	%22
	User Account Control:	%23
	User Parameters:	%24
	Sid History:	%25
	Logon Hours:	%26

ID: 643 Description: Domain Policy Changed: %1 modified
	Domain Name:		%2
	Domain ID:	%3
	Caller User Name:	%4
	Caller Domain:	%5
	Caller Logon ID:	%6
	Privileges:	%7
Changed Attributes:
	Min. Password Age:	%8
	Max. Password Age:	%9
	Force Logoff:	%10
	Lockout Threshold:	%11
	Lockout Observation Window:	%12
	Lockout Duration:	%13
	Password Properties:	%14
	Min. Password Length:	%15
	Password History Length:	%16
	Machine Account Quota:	%17  
	Mixed Domain Mode:	%18
	Domain Behavior Version:	%19
	OEM Information:	%20

ID: 644 Description: User Account Locked Out:
	Target Account Name:	%1
	Target Account ID:	%3
	Caller Machine Name:	%2
	Caller User Name:	%4
	Caller Domain:	%5
	Caller Logon ID:	%6

ID: 645 Description: Computer Account Created:
	New Account Name:	%1
	New Domain:	%2
	New Account ID:	%3
	Caller User Name:	%4
	Caller Domain:	%5
	Caller Logon ID:	%6
	Privileges		%7
Attributes:
	Sam Account Name:	%8
	Display Name:	%9
	User Principal Name:	%10
	Home Directory:	%11
	Home Drive:	%12
	Script Path:	%13
	Profile Path:	%14
	User Workstations:	%15
	Password Last Set:	%16
	Account Expires:	%17
	Primary Group ID:	%18
	AllowedToDelegateTo:	%19
	Old UAC Value:	%20
	New UAC Value:	%21
	User Account Control:	%22
	User Parameters:	%23
	Sid History:	%24
	Logon Hours:	%25
	DNS Host Name:	%26
	Service Principal Names:	%27 

ID: 646 Description: Computer Account Changed:
	%1
	Target Account Name:	%2
	Target Domain:	%3
	Target Account ID:	%4
	Caller User Name:	%5
	Caller Domain:	%6
	Caller Logon ID:	%7
	Privileges:	%8
Changed Attributes:
	Sam Account Name:	%9
	Display Name:	%10
	User Principal Name:	%11
	Home Directory:	%12
	Home Drive:	%13
	Script Path:	%14
	Profile Path:	%15
	User Workstations:	%16
	Password Last Set:	%17
	Account Expires:	%18
	Primary Group ID:	%19
	AllowedToDelegateTo:	%20
	Old UAC Value:	%21
	New UAC Value:	%22
	User Account Control:	%23
	User Parameters:	%24
	Sid History:	%25
	Logon Hours:	%26
	DNS Host Name:	%27
	Service Principal Names:	%28 

ID: 647 Description: Computer Account Deleted:
	Target Account Name:	%1
	Target Domain:	%2
	Target Account ID:	%3
	Caller User Name:	%4
	Caller Domain:	%5
	Caller Logon ID:	%6
	Privileges:	%7

ID: 648 Description: Security Disabled Local Group Created:
	Target Account Name:	%1
	Target Domain:	%2
	Target Account ID:	%3
	Caller User Name:	%4
	Caller Domain:	%5
	Caller Logon ID:	%6
	Privileges:	%7
Attributes:
	Sam Account Name:	%8
	Sid History:	%9

ID: 649 Description: Security Disabled Local Group Changed:
	Target Account Name:	%1
	Target Domain:	%2
	Target Account ID:	%3
	Caller User Name:	%4
	Caller Domain:	%5
	Caller Logon ID:	%6
	Privileges:	%7
Changed Attributes:
	Sam Account Name:	%8
	Sid History:	%9

ID: 650 Description: Security Disabled Local Group Member Added:
	Member Name:	%1
	Member ID:	%2
	Target Account Name:	%3
	Target Domain:	%4
	Target Account ID:	%5
	Caller User Name:	%6
	Caller Domain:	%7
	Caller Logon ID:	%8
	Privileges:	%9

ID: 651 Description: Security Disabled Local Group Member Removed:
	Member Name:	%1
	Member ID:	%2
	Target Account Name:	%3
	Target Domain:	%4
	Target Account ID:	%5
	Caller User Name:	%6
	Caller Domain:	%7
	Caller Logon ID:	%8
	Privileges:	%9

ID: 652 Description: Security Disabled Local Group Deleted:
	Target Account Name:	%1
	Target Domain:	%2
	Target Account ID:	%3
	Caller User Name:	%4
	Caller Domain:	%5
	Caller Logon ID:	%6
	Privileges:	%7

ID: 653 Description: Security Disabled Global Group Created:
	New Account Name:	%1
	New Domain:	%2
	New Account ID:	%3
	Caller User Name:	%4
	Caller Domain:	%5
	Caller Logon ID:	%6
	Privileges:	%7
Attributes:
	Sam Account Name:	%8
	Sid History:	%9

ID: 654 Description: Security Disabled Global Group Changed:
	Target Account Name:	%1
	Target Domain:	%2
	Target Account ID:	%3
	Caller User Name:	%4
	Caller Domain:	%5
	Caller Logon ID:	%6
	Privileges:	%7
Changed Attributes:
	Sam Account Name:	%8
	Sid History:	%9

ID: 655 Description: Security Disabled Global Group Member Added:
	Member Name:	%1
	Member ID:	%2
	Target Account Name:	%3
	Target Domain:	%4
	Target Account ID:	%5
	Caller User Name:	%6
	Caller Domain:	%7
	Caller Logon ID:	%8
	Privileges:	%9

ID: 656 Description: Security Disabled Global Group Member Removed:
	Member Name:	%1
	Member ID:	%2
	Target Account Name:	%3
	Target Domain:	%4
	Target Account ID:	%5
	Caller User Name:	%6
	Caller Domain:	%7
	Caller Logon ID:	%8
	Privileges:	%9

ID: 657 Description: Security Disabled Global Group Deleted:
	Target Account Name:	%1
	Target Domain:	%2
	Target Account ID:	%3
	Caller User Name:	%4
	Caller Domain:	%5
	Caller Logon ID:	%6
	Privileges:	%7

ID: 658 Description: Security Enabled Universal Group Created:
	New Account Name:	%1
	New Domain:	%2
	New Account ID:	%3
	Caller User Name:	%4
	Caller Domain:	%5
	Caller Logon ID:	%6
	Privileges:	%7
Attributes:
	Sam Account Name:	%8
	Sid History:	%9

ID: 659 Description: Security Enabled Universal Group Changed:
	Target Account Name:	%1
	Target Domain:	%2
	Target Account ID:	%3
	Caller User Name:	%4
	Caller Domain:	%5
	Caller Logon ID:	%6
	Privileges:	%7
Changed Attributes:
	Sam Account Name:	%8
	Sid History:	%9

ID: 660 Description: Security Enabled Universal Group Member Added:
	Member Name:	%1
	Member ID:	%2
	Target Account Name:	%3
	Target Domain:	%4
	Target Account ID:	%5
	Caller User Name:	%6
	Caller Domain:	%7
	Caller Logon ID:	%8
	Privileges:	%9

ID: 661 Description: Security Enabled Universal Group Member Removed:
	Member Name:	%1
	Member ID:	%2
	Target Account Name:	%3
	Target Domain:	%4
	Target Account ID:	%5
	Caller User Name:	%6
	Caller Domain:	%7
	Caller Logon ID:	%8
	Privileges:	%9

ID: 662 Description: Security Enabled Universal Group Deleted:
	Target Account Name:	%1
	Target Domain:	%2
	Target Account ID:	%3
	Caller User Name:	%4
	Caller Domain:	%5
	Caller Logon ID:	%6
	Privileges:	%7

ID: 663 Description: Security Disabled Universal Group Created:
	New Account Name:	%1
	New Domain:	%2
	New Account ID:	%3
	Caller User Name:	%4
	Caller Domain:	%5
	Caller Logon ID:	%6
	Privileges:	%7
Attributes:
	Sam Account Name:	%8
	Sid History:	%9

ID: 664 Description: Security Disabled Universal Group Changed:
	Target Account Name:	%1
	Target Domain:	%2
	Target Account ID:	%3
	Caller User Name:	%4
	Caller Domain:	%5
	Caller Logon ID:	%6
	Privileges:	%7
Changed Attributes:
	Sam Account Name:	%8
	Sid History:	%9

ID: 665 Description: Security Disabled Universal Group Member Added:
	Member Name:	%1
	Member ID:	%2
	Target Account Name:	%3
	Target Domain:	%4
	Target Account ID:	%5
	Caller User Name:	%6
	Caller Domain:	%7
	Caller Logon ID:	%8
	Privileges:	%9

ID: 666 Description: Security Disabled Universal Group Member Removed:
	Member Name:	%1
	Member ID:	%2
	Target Account Name:	%3
	Target Domain:	%4
	Target Account ID:	%5
	Caller User Name:	%6
	Caller Domain:	%7
	Caller Logon ID:	%8
	Privileges:	%9

ID: 667 Description: Security Disabled Universal Group Deleted:
	Target Account Name:	%1
	Target Domain:	%2
	Target Account ID:	%3
	Caller User Name:	%4
	Caller Domain:	%5
	Caller Logon ID:	%6
	Privileges:	%7

ID: 668 Description: Group Type Changed:
	%1
	Target Account Name:	%2
	Target Domain:	%3
	Target Account ID:	%4
	Caller User Name:	%5
	Caller Domain:	%6
	Caller Logon ID:	%7
	Privileges:	%8

ID: 669 Description: Add SID History:
	Source Account Name:	%1
	Source Account ID:	%2
	Target Account Name:	%3
	Target Domain:	%4
	Target Account ID:	%5
	Caller User Name:	%6
	Caller Domain:	%7
	Caller Logon ID:	%8
	Privileges:	%9
	SidList:	%10

ID: 670 Description: Add SID History:
	Source Account Name:	%1
	Target Account Name:	%2
	Target Domain:	%3
	Target Account ID:	%4
	Caller User Name:	%5
	Caller Domain:	%6
	Caller Logon ID:	%7
	Privileges:	%8

ID: 671 Description: User Account Unlocked:
	Target Account Name:	%1
	Target Domain:		%2
	Target Account ID:	%3
	Caller User Name:	%4
	Caller Domain:	%5
	Caller Logon ID:	%6

ID: 672 Description: Authentication Ticket Request:
	User Name:		%1
	Supplied Realm Name:	%2
	User ID:			%3
	Service Name:		%4
	Service ID:		%5
	Ticket Options:		%6
	Result Code:		%7
	Ticket Encryption Type:	%8
	Pre-Authentication Type:	%9
	Client Address:		%10
	Certificate Issuer Name:	%11
	Certificate Serial Number:	%12
	Certificate Thumbprint:	%13

ID: 673 Description: Service Ticket Request:
	User Name:		%1
	User Domain:		%2
	Service Name:		%3
	Service ID:		%4
	Ticket Options:		%5
	Ticket Encryption Type:	%6
	Client Address:		%7
	Failure Code:		%8
	Logon GUID:		%9
	Transited Services:	%10

ID: 674 Description: Service Ticket Renewed:
	User Name:	%1
	User Domain:	%2
	Service Name:	%3
	Service ID:	%4
	Ticket Options:	%5
	Ticket Encryption Type:	%6
	Client Address:	%7

ID: 675 Description: Pre-authentication failed:
	User Name:	%1
	User ID:		%2
	Service Name:	%3
	Pre-Authentication Type:	%4
	Failure Code:	%5
	Client Address:	%6

ID: 676 Description: Authentication Ticket Request Failed:
	User Name:	%1
	Supplied Realm Name:	%2
	Service Name:	%3
	Ticket Options:	%4
	Failure Code:	%5
	Client Address:	%6

ID: 677 Description: Service Ticket Request Failed:
	User Name:	%1
	User Domain:	%2
	Service Name:	%3
	Ticket Options:	%4
	Failure Code:	%5
	Client Address:	%6

ID: 678 Description: Account Mapped for Logon.
Mapping Attempted By: 
	%1
Client Name:
	%2
	Mapped Name:
	%3

ID: 679 Description: The name:
	%2
could not be mapped for logon by:
	%1

ID: 680 Description: Logon attempt by:	%1
Logon account:	%2
Source Workstation:	%3
Error Code:	%4

ID: 681 Description: The logon to account: %2
by: %1
from workstation: %3
failed. The error code was: %4

ID: 682 Description: Session reconnected to winstation:
	User Name:	%1
	Domain:		%2
	Logon ID:		%3
	Session Name:	%4
	Client Name:	%5
	Client Address:	%6

ID: 683 Description: Session disconnected from winstation:
	User Name:	%1
	Domain:		%2
	Logon ID:		%3
	Session Name:	%4
	Client Name:	%5
	Client Address:	%6

ID: 684 Description: Set ACLs of members in administrators groups:
	Target Account Name:	%1
	Target Domain:		%2
	Target Account ID:	%3
	Caller User Name:	%4
	Caller Domain:	%5
	Caller Logon ID:	%6
	Privileges:	%7

ID: 685 Description: Account Name Changed: 
	Old Account Name:	%1
	New Account Name:	%2
	Target Domain:		%3
	Target Account ID:	%4
	Caller User Name:	%5
	Caller Domain:	%6
	Caller Logon ID:	%7
	Privileges:	%8

ID: 686 Description: Password of the following user accessed:
	Target User Name:	%1
	Target User Domain:		%2
By user:
	Caller User Name:	%3
	Caller Domain:		%4
	Caller Logon ID:		%5

ID: 687 Description: Basic Application Group Created:
	New Account Name:	%1
	New Domain:	%2
	New Account ID:	%3
	Caller User Name:	%4
	Caller Domain:	%5
	Caller Logon ID:	%6
	Privileges:	%7
Attributes:
	Sam Account Name:	%8
	Sid History:	%9

ID: 688 Description: Basic Application Group Changed:
	New Account Name:	%1
	New Domain:	%2
	New Account ID:	%3
	Caller User Name:	%4
	Caller Domain:	%5
	Caller Logon ID:	%6
	Privileges:	%7
Changed Attributes:
	Sam Account Name:	%8
	Sid History:	%9

ID: 689 Description: Basic Application Group Member Added:
	Member Name:	%1
	Member ID:	%2
	Target Account Name:	%3
	Target Domain:	%4
	Target Account ID:	%5
	Caller User Name:	%6
	Caller Domain:	%7
	Caller Logon ID:	%8
	Privileges:	%9

ID: 690 Description: Basic Application Group Member Removed:
	Member Name:	%1
	Member ID:	%2
	Target Account Name:	%3
	Target Domain:	%4
	Target Account ID:	%5
	Caller User Name:	%6
	Caller Domain:	%7
	Caller Logon ID:	%8
	Privileges:	%9

ID: 691 Description: Basic Application Group Non-Member Added:
	Member Name:	%1
	Member ID:	%2
	Target Account Name:	%3
	Target Domain:	%4
	Target Account ID:	%5
	Caller User Name:	%6
	Caller Domain:	%7
	Caller Logon ID:	%8
	Privileges:	%9

ID: 692 Description: Basic Application Group Non-Member Removed:
	Member Name:	%1
	Member ID:	%2
	Target Account Name:	%3
	Target Domain:	%4
	Target Account ID:	%5
	Caller User Name:	%6
	Caller Domain:	%7
	Caller Logon ID:	%8
	Privileges:	%9

ID: 693 Description: Basic Application Group Deleted:
	Target Account Name:	%1
	Target Domain:	%2
	Target Account ID:	%3
	Caller User Name:	%4
	Caller Domain:	%5
	Caller Logon ID:	%6
	Privileges:	%7

ID: 694 Description: LDAP Query Group Created:
	New Account Name:	%1
	New Domain:	%2
	New Account ID:	%3
	Caller User Name:	%4
	Caller Domain:	%5
	Caller Logon ID:	%6
	Privileges:	%7
Attributes:
	Sam Account Name:	%8
	Sid History:	%9

ID: 695 Description: LDAP Query Group Changed:
	New Account Name:	%1
	New Domain:	%2
	New Account ID:	%3
	Caller User Name:	%4
	Caller Domain:	%5
	Caller Logon ID:	%6
	Privileges:	%7
Changed Attributes:
	Sam Account Name:	%8
	Sid History:	%9

ID: 696 Description: LDAP Query Group Deleted:
	Target Account Name:	%1
	Target Domain:	%2
	Target Account ID:	%3
	Caller User Name:	%4
	Caller Domain:	%5
	Caller Logon ID:	%6
	Privileges:	%7

ID: 697 Description: Password Policy Checking API is called:
	Caller Username:	%1
	Caller Domain:	%2
	Caller Logon ID:	%3
	Caller Workstation:	%4
	Provided User Name (unauthenticated):	%5
	Status Code:	%6

ID: 698 Description: An attempt to set the Directory Services Restore Mode 
administrator password has been made.
	Caller Username:	%1
	Caller Domain:	%2
	Caller Logon ID:	%3
	Caller Workstation:	%4
	Status Code:	%5

ID: 768 Description: Namespace collision detected:
	Target type:	%1
	Target name:	%2
	Forest Root:	%3
	Top Level Name:	%4
	DNS Name:	%5
	NetBIOS Name:	%6
	SID:		%7
	New Flags:	%8

ID: 769 Description: Trusted Forest Information Entry Added:
	Forest Root:	%1
	Forest Root SID:	%2
	Operation ID:	{%3,%4}
	Entry Type:	%5
	Flags:		%6
	Top Level Name:	%7
	DNS Name:	%8
	NetBIOS Name:	%9
	Domain SID:	%10
	Added by	:
	Client User Name:	%11
	Client Domain:	%12
	Client Logon ID:	%13

ID: 770 Description: Trusted Forest Information Entry Removed:
	Forest Root:	%1
	Forest Root SID:	%2
	Operation ID:	{%3,%4}
	Entry Type:	%5
	Flags:		%6
	Top Level Name:	%7
	DNS Name:	%8
	NetBIOS Name:	%9
	Domain SID:	%10
	Removed by	:
	Client User Name:	%11
	Client Domain:	%12
	Client Logon ID:	%13

ID: 771 Description: Trusted Forest Information Entry Modified:
	Forest Root:	%1
	Forest Root SID:	%2
	Operation ID:	{%3,%4}
	Entry Type:	%5
	Flags:		%6
	Top Level Name:	%7
	DNS Name:	%8
	NetBIOS Name:	%9
	Domain SID:	%10
	Modified by	:
	Client User Name:	%11
	Client Domain:	%12
	Client Logon ID:	%13

ID: 772 Description: The certificate manager denied a pending certificate request.

Request ID:	%1

ID: 773 Description: Certificate Services received a resubmitted certificate request.

Request ID:	%1

ID: 774 Description: Certificate Services revoked a certificate.

Serial No:	%1
Reason:	%2

ID: 775 Description: Certificate Services received a request to publish the certificate revocation list (CRL).

Next Update:	%1
Publish Base:	%2
Publish Delta:	%3

ID: 776 Description: Certificate Services published the certificate revocation list (CRL).

Base CRL:	%1
CRL No:		%2
Key Container:	%3
Next Publish:	%4
Publish URLs:	%5

ID: 777 Description: A certificate request extension changed.

Request ID:	%1
Name:	%2
Type:	%3
Flags:	%4
Data:	%5

ID: 778 Description: One or more certificate request attributes changed.

Request ID:	%1
Attributes:	%2

ID: 779 Description: Certificate Services received a request to shut down.

ID: 780 Description: Certificate Services backup started.
Backup Type:	%1

ID: 781 Description: Certificate Services backup completed.

ID: 782 Description:  Certificate Services restore started.

ID: 783 Description: Certificate Services restore completed.

ID: 784 Description: Certificate Services started.

Certificate Database Hash:	%1
Private Key Usage Count:	%2
CA Certificate Hash:	%3
CA Public Key Hash:	%4

ID: 785 Description: Certificate Services stopped.

Certificate Database Hash:	%1
Private Key Usage Count:	%2
CA Certificate Hash:	%3
CA Public Key Hash:	%4

ID: 786 Description: The security permissions for Certificate Services changed.

%1

ID: 787 Description: Certificate Services retrieved an archived key.

Request ID:	%1

ID: 788 Description: Certificate Services imported a certificate into its database.

Certificate:	%1
Request ID:	%2

ID: 789 Description: The audit filter for Certificate Services changed.

Filter:	%1

ID: 790 Description: Certificate Services received a certificate request.

Request ID:	%1
Requester:	%2
Attributes:	%3

ID: 791 Description: Certificate Services approved a certificate request and issued a certificate.

Request ID:	%1
Requester:	%2
Attributes:	%3
Disposition:	%4
SKI:		%5
Subject:	%6

ID: 792 Description: Certificate Services denied a certificate request.

Request ID:	%1
Requester:	%2
Attributes:	%3
Disposition:	%4
SKI:		%5
Subject:	%6

ID: 793 Description: Certificate Services set the status of a certificate request to pending.

Request ID:	%1
Requester:	%2
Attributes:	%3
Disposition:	%4
SKI:		%5
Subject:	%6

ID: 794 Description: The certificate manager settings for Certificate Services changed.

Enable:	%1

%2

ID: 795 Description: A configuration entry changed in Certificate Services.

Node:	%1
Entry:	%2
Value:	%3

ID: 796 Description: A property of Certificate Services changed.

Property:	%1
Index:	%2
Type:	%3
Value:	%4

ID: 797 Description: Certificate Services archived a key.

Request ID:	%1
Requester:	%2
KRA Hashes:	%3

ID: 798 Description: Certificate Services imported and archived a key.

Request ID:	%1

ID: 799 Description: Certificate Services published the CA certificate to Active Directory.

Certificate Hash:	%1
Valid From:	%2
Valid To:	%3

ID: 800 Description: One or more rows have been deleted from the certificate database.

Table ID:	%1
Filter:	%2
Rows Deleted:	%3

ID: 801 Description: Role separation enabled:	%1

ID: 805 Description: Configuration of security log for this session:
	Maximum Log Size (KB): %1
	Action to take on reaching max log size: %2
	Event age limit in days: %3

ID: 806 Description: Per User Audit Policy was refreshed.
	Number of elements:	%1
	Policy ID:	%2

ID: 807 Description: Per user auditing policy set for user:
	Target user:	%1
	Policy ID:	%2
	Category Settings:
	 System:	%3
	 Logon:	%4
	 Object Access	%5
	 Privilege Use:	%6
	 Detailed Tracking:	%7
	 Policy Change:	%8
	 Account Management:	%9
	 DS Access:	%10
	 Account Logon:	%11

ID: 808 Description: A security event source has attempted to register.
	Primary User Name:	%1
	Primary Domain:	%2
	Primary Logon ID:	%3
	Client User Name:	%4
	Client Domain:	%5
	Client Logon ID:	%6
	Source Name:	%7
	Process Id:	%8
	Event Source Id:	%9

ID: 809 Description: A security event source has attempted to unregister.
	Primary User Name:	%1
	Primary Domain:	%2
	Primary Logon ID:	%3
	Client User Name:	%4
	Client Domain:	%5
	Client Logon ID:	%6
	Source Name:	%7
	Process Id:	%8
	Event Source Id:	%9

ID: 832 Description: 	Destination DRA:	%1
	Source DRA:	%2
	Source Addr:	%3
	Naming Context:	%4
	Options:	%5
	Status Code:	%6

ID: 833 Description: 	Destination DRA:	%1
	Source DRA:	%2
	Source Addr:	%3
	Naming Context:	%4
	Options:	%5
	Status Code:	%6

ID: 834 Description: 	Destination DRA:	%1
	Source DRA:	%2
	Source Addr:	%3
	Naming Context:	%4
	Options:	%5
	Status Code:	%6

ID: 835 Description: 	Destination DRA:	%1
	Source DRA:	%2
	Dest. Addr:	%3
	Naming Context:	%4
	Options:	%5
	Status Code:	%6

ID: 836 Description: 	Destination DRA:	%1
	Source DRA:	%2
	Naming Context:	%3
	Options:	%4
	Session ID:	%5
	Start USN:	%6

ID: 837 Description: 	Destination DRA:	%1
	Source DRA:	%2
	Naming Context:	%3
	Options:	%4
	Session ID:	%5
	End USN:	%6
	Status Code:	%7

ID: 838 Description: 	Session ID:	%1
	Object:	%2
	Attribute:	%3
	Type of change:	%4
	New Value:	%5
	USN:	%6
	Status Code:	%7

ID: 839 Description: 	Replication Event:	%1
	Audit Status Code:	%2

ID: 840 Description: 	Replication Event:	%1
	Audit Status Code:	%2
	Replication Status Code:	%3

ID: 841 Description: 	Destination DRA:	%1
	Source DRA:	%2
	Object:	%3
	Options:	%4
	Status Code:	%5

ID: 4095 Description: Highest System-Defined Audit Message Value.