#windows-events

Windows Event ID 24586 – Unknown: Application or Service Initialization Error

Event ID 24586 indicates an application or service failed to initialize properly during startup. This error typically occurs when Windows components or third-party applications encounter configuration issues, missing dependencies, or permission problems during the initialization process.

Windows Event ID 24582 – Unknown: Application or Service Initialization Failure

Event ID 24582 indicates a critical initialization failure in an application or service component during system startup or service launch, requiring immediate investigation to identify the failing component.

Windows Event ID 24579 – Unknown: System Component Registration or Service Initialization Event

Event ID 24579 typically indicates a system component registration, service initialization, or driver loading event. This informational event appears during system startup or when specific Windows services are starting.

Windows Event ID 11708 – Microsoft-Windows-Kernel-General: System Time Change Detected

Event ID 11708 indicates the system time was changed, either manually by a user or automatically by time synchronization services. Critical for security auditing and troubleshooting time-related issues.

Windows Event ID 6145 – WinLogon: User Logon Session Destroyed

Event ID 6145 indicates a user logon session has been destroyed by the Windows Logon service, typically occurring during normal logoff, system shutdown, or forced session termination.

Windows Event ID 6009 – EventLog: Microsoft Windows Kernel Boot Information

Event ID 6009 records Windows kernel boot information including processor details, memory configuration, and system architecture during system startup.

Windows Event ID 5889 – Microsoft-Windows-Kernel-General: System Time Change Detected

Event ID 5889 indicates the system time was changed, either manually by a user or automatically by time synchronization services. This event helps track time modifications for security and audit purposes.

Windows Event ID 5121 – Microsoft-Windows-Kernel-General: System Time Change Detected

Event ID 5121 fires when Windows detects a system time change, either manual adjustment or automatic synchronization. Critical for security auditing and troubleshooting time-related issues.

Windows Event ID 4950 – Microsoft-Windows-Kernel-General: System Time Changed

Event ID 4950 fires when the system time is changed on a Windows machine, either manually by a user or automatically by time synchronization services.

Windows Event ID 4946 – Microsoft-Windows-Kernel-Power: System Power State Transition

Event ID 4946 indicates a system power state transition, typically when Windows enters or exits sleep, hibernation, or other power management states. Critical for diagnosing power-related issues.

Windows Event ID 1085 – EventLog: Event Log Service Automatic Backup

Event ID 1085 indicates the Windows Event Log service has automatically backed up a log file when it reached maximum size or retention limits.

Windows Event ID 1074 – User32: System Restart or Shutdown Initiated

Event ID 1074 records when a system restart or shutdown is initiated by a user or application. This informational event tracks who initiated the action and the reason code.