http://blogs.msdn.com/b/ericfitz/archive/2009/06/10/mapping-pre-vista-security-event-ids-to-security-event-ids-in-vista.aspxI've written twice ( here and here ) about the relationship between the "old" event IDs (5xx-6xx) in WS03 and earlier versions of Windows, and between the "new" security event IDs (4xxx-5xxx) in Vista and beyond. In short, EventID(WS03) + 4096 = EventIDen-USTelligent Evolution Platform Developer Build (Build: 5.6.50428.7875)http://blogs.msdn.com/b/ericfitz/archive/2009/06/10/mapping-pre-vista-security-event-ids-to-security-event-ids-in-vista.aspx#9739145Sat, 13 Jun 2009 00:05:12 GMT91d46819-8472-40ad-a661-2c78acb4018c:9739145Andrew Hay &raquo; Blog Archive &raquo; links for 2009-06-12<p>PingBack from <a rel="nofollow" target="_new" href="http://www.andrewhay.ca/archives/872">http://www.andrewhay.ca/archives/872</a></p> <img src="http://blogs.msdn.com/aggbug.aspx?PostID=9739145" width="1" height="1">