Events supported for asset activities

The Activities tab in the Asset details overlay shows recent events related to an asset.

Access events

These events help track user authentication and session activity.

Event ID Event name Logon type requested Description
4624 Successful logon 2: Interactive
7: Unlock
10: RemoteInteractive
11: CachedInteractive 		Occurs when a logon session is created on the destination machine.
4625 Failed logon attempt Same as above Occurs when a logon attempt fails on the local machine.
4634 Logoff 2: Interactive
10: RemoteInteractive 		Occurs when a logon session ends and no longer exists.
4800 Workstation locked 2: Interactive Occurs when a local session is locked.
4801 Workstation unlocked 7: Unlock Occurs when a local session is unlocked.

System shutdown and restart events

These events help you understand when a device rebooted or powered off and what caused the change.

Event ID Event name Description
1074 Shutdown / Restart initiated Occurs when a shutdown or restart is intentionally initiated. It records who or what initiated the shutdown, what triggered it, and why.

This information can help you explain uptime resets, user complaints, and help you rule out crashes.
1076 Unexpected Shutdown Occurs after a system has already restarted from an unexpected shutdown, and someone later selects a reason for that shutdown.

This information can help you differentiate between a crash or a planned restarted.

System crash events

These events indicate system-level failures or shutdowns.

Event ID Event name Description
41 System kernel-general crash Occurs when the system restarts unexpectedly without cleanly shutting down first.
1001 Application crash Occurs when Windows Error Reporting has logged an application error or crash. Common BugCheck codes include:
  • 0x0000000A — IRQL_NOT_LESS_OR_EQUAL: Driver accessed memory at too high IRQL
  • 0x0000003B — SYSTEM_SERVICE_EXCEPTION: System service caused an exception
  • 0x0000007B — INACCESSIBLE_BOOT_DEVICE: System cannot access the boot device during startup
  • 0x0000007E — SYSTEM_THREAD_EXCEPTION_NOT_HANDLED: System thread generated exception
  • 0x00000074 — BAD_SYSTEM_CONFIG_INFO: Registry contains invalid information
  • 0x00000080 — NMI_HARDWARE_FAILURE: Hardware malfunction detected by NMI
  • 0x0000009C — MACHINE_CHECK_EXCEPTION: Fatal machine check exception occurred
  • 0x00000101 — CLOCK_WATCHDOG_TIMEOUT: Multiprocessor system clock watchdog timeout
  • 0x00000124 — WHEA_UNCORRECTABLE_ERROR: Hardware error detected by WHEA
  • 0x000000EF — CRITICAL_PROCESS_DIED: Critical system process terminated unexpectedly
6008 Unexpected system shutdown Occurs when the system shuts down unexpectedly.

Related articles