Windows-itpro-docs: Audit logs for Windows 10/Server 2008+ showing XP/Win2K Event IDs

[marcnil815]

Hi

It looks like all the Event IDs listed here are pre Vista/2008 style:
windows-itpro-docs/windows/security/threat-protection/auditing/basic-audit-logon-events.md

Likewise all the other events in that tree.

[marcnil815]

See also #2464

[illfated]

Working links, based on OP's comment:

• https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events
• https://github.com/MicrosoftDocs/windows-itpro-docs/blob/public/windows/security/threat-protection/auditing/basic-audit-logon-events.md

[joinimran]

@Dansimp - Can you please guide what should be added here(https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events). These all event ids are linked with old OS like Windows XP, Win 7 but not with Windows 10.

I have found a list of the Events IDs here (https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/appendix-l--events-to-monitor) but not sure which ones should be added in the document.

Please suggest.

@e0i - FYI Please.

Thanks.