What are the Windows 2000 Security Log Event IDs for 'Account Management' in User, Group and Compute (NETIQKB7585)

goal
What are the Windows 2000 Security Log Event IDs for 'Account Management' in User, Group and Computer Migrations?

fact
Domain Migration Administrator 6.x

fact
Domain Migration Administrator 7.x

fix

The following are the Event IDs for the 'Account Management' events in the Security Log in the Event Viewer for Windows 2000 Server. These will only be available if Success and/or Failure auditing of Account Management has been enabled.  The Security Log should be reviewed on the target domain controller.

User Account

624 - User Account Created
625 - User Account Type Changed
626 - User Account Enabled
627 - Change Password Attempt
628 - User Account Password Set
629 - User Account Disabled
630 - User Account Deleted

Global Group

631 - Security Enabled Global Group Created
632 - Security Enabled Global Group Member Added
633 - Security Enabled Global Group Member Removed
634 - Security Enabled Global Group Deleted

Local Group

635 - Security Enabled Local Group Created
636 - Security Enabled Local Group Member Added
637 - Security Enabled Local Group Member Removed
638 - Security Enabled Local Group Deleted

Computer Account

645 - Computer Account Created
646 - Computer Account Changed
647 - Computer Account Deleted

SID History

669 - Sid History added

note
Please refer to the Microsoft knowledge base article 301677 for a more extensive list of Security audit events regarding account management.

Formerly known as NETIQKB7585