-
Successful login attempts
-
User account deleted
-
Hardware driver failures
-
Shutdown events
EXPLANATION
All of the above events will be logged in the Windows event log, however there are several different
types of log that each contain relevant information.
Application log - contains logging information of events generated by applications.
Security log - contains information related to logon attempts, password changes, group membership, etc.
System
log - contains information related to Windows system components, such
as driver failures. These logs are predetermined by Windows.
Setup log - contains events related to application setup
ForwardedEvents log - used to store events collected from remote computers
The above alerts appear in the Windows security log as:
Event ID 4624 -
An account was successfully logged on
Event ID 4609 - Windows is shutting down
Event ID 4726 - User account was deleted
Hardware driver failures will appear in the system log
SOURCE
https://technet.microsoft.com/en-us/library/cc722404(v=ws.11).aspx