What are the Windows 2000 Security Log Event IDs for 'Account Management' in User, Group and Computer Migrations?
Domain Migration Administrator 6.x
Domain Migration Administrator 7.x
The following are the Event IDs for the 'Account Management' events in the Security Log in the Event Viewer for Windows 2000 Server. These will only be available if Success and/or Failure auditing of Account Management has been enabled. The Security Log should be reviewed on the target domain controller.
624 - User Account Created
625 - User Account Type Changed
626 - User Account Enabled
627 - Change Password Attempt
628 - User Account Password Set
629 - User Account Disabled
630 - User Account Deleted
631 - Security Enabled Global Group Created
632 - Security Enabled Global Group Member Added
633 - Security Enabled Global Group Member Removed
634 - Security Enabled Global Group Deleted
635 - Security Enabled Local Group Created
636 - Security Enabled Local Group Member Added
637 - Security Enabled Local Group Member Removed
638 - Security Enabled Local Group Deleted
645 - Computer Account Created
646 - Computer Account Changed
647 - Computer Account Deleted
669 - Sid History added
Please refer to the Microsoft knowledge base article 301677 for a more extensive list of Security audit events regarding account management.