More Windows Event Log Info

Logon/Logoff Events

• 528 - Successful logon
• 538 - Logoff
• Logon Types: 2 - interactive; 3 - network; 4 - batch job; 5 - service; 7 - lock/unlock

Object Access

• 560 - Successful object access
• 562 - Object handle closed
• 564 - Object deleted
• 567 - Permission associated with a handle was used.

References:
http://technet.microsoft.com/en-us/library/cc751315.aspx
http://technet.microsoft.com/en-us/library/cc163121.aspx