About EventID

EventID is a reference for Windows Server event IDs that are easy to find in the Event Viewer and hard to act on: a logon failure with three possible causes, a service that terminated without saying why, an account lockout with no obvious source.

How pages are written

Each page is built from a real event, exported from a test machine. The event block shown on the page is the actual message text, including the fields that matter — Logon Type, Sub Status, failure code, service name — because those fields decide which fix applies.

Before publishing, the diagnostic commands on the page are run against the same event. If a command needs an elevated prompt or the Security log, the page says so.

What this site is not

• It is not a Microsoft knowledge base article, and it is not affiliated with Microsoft. Product names are used descriptively.
• It does not cover every event ID. It covers the ones that produce the same question repeatedly.
• It does not recommend registry edits or GPO changes without naming the risk.

Who writes it

Shen Lijun, who works with Windows and Linux servers and prefers a log line to a dashboard.

Corrections

If an event on your system does not match the fields described here, send the event XML through the contact page — different Windows versions do change the message layout, and that is worth correcting.