#system-startup

Windows Event ID 4609 – Security: Windows is Starting Up

Event ID 4609 records when Windows begins its startup process. This security audit event fires during system boot and provides critical timing information for security monitoring and forensic analysis.

Windows Event ID 6004 – EventLog: Event Log Service Started

Event ID 6004 indicates the Windows Event Log service has successfully started. This informational event confirms the logging subsystem is operational and ready to record system events.

Windows Event ID 325 – System: Boot Configuration Data Store Corruption

Event ID 325 indicates corruption or issues with the Boot Configuration Data (BCD) store, typically occurring during system startup when Windows cannot properly read boot configuration settings.

Windows Event ID 4004 – WinLogon: Interactive Logon Process Initialization

Event ID 4004 indicates the Windows interactive logon process has been initialized. This informational event fires during system startup when WinLogon prepares the interactive desktop environment for user authentication.

Windows Event ID 4608 – Security: Windows System Startup Initialization

Event ID 4608 logs when Windows starts up and the Local Security Authority Subsystem Service (LSASS.EXE) initializes the auditing subsystem during system boot.