# Event Log Artifacts

- [Task Scheduler Operational Log](/windows-forensics/artifacts-by-type/event-log-artifacts/task-scheduler-operational-log.md)
- [TerminalServices-RDPClient](/windows-forensics/artifacts-by-type/event-log-artifacts/terminalservices-rdpclient.md)
- [EventID 1024: RDP ClientActiveX is trying to connect to the server](/windows-forensics/artifacts-by-type/event-log-artifacts/terminalservices-rdpclient/evtx-1024-rdp-activex.md)
- [Security](/windows-forensics/artifacts-by-type/event-log-artifacts/security.md)
- [EventID 4688: A new process has been created](/windows-forensics/artifacts-by-type/event-log-artifacts/security/evtx-4688-process-created.md)
- [EventID 4624: An account was successfully logged on](/windows-forensics/artifacts-by-type/event-log-artifacts/security/evtx-4624-successful-logon.md)
- [System](/windows-forensics/artifacts-by-type/event-log-artifacts/system.md)
- [Event ID 7045: Service Installed](/windows-forensics/artifacts-by-type/event-log-artifacts/system/evtx-7045-service-install.md)
- [Microsoft Windows Windows Firewall With Advanced Security](/windows-forensics/artifacts-by-type/event-log-artifacts/microsoft-windows-windows-firewall-with-advanced-security.md)
- [EventID 2004: Firewall Rule Added](/windows-forensics/artifacts-by-type/event-log-artifacts/microsoft-windows-windows-firewall-with-advanced-security/evtx-2004-firewall.md)
- [EventID 2005: Firewall Rule Modified](/windows-forensics/artifacts-by-type/event-log-artifacts/microsoft-windows-windows-firewall-with-advanced-security/evtx-2005-firewall.md)
- [EventID 2006: Firewall Rule Deleted](/windows-forensics/artifacts-by-type/event-log-artifacts/microsoft-windows-windows-firewall-with-advanced-security/evtx-2006-firewall.md)
- [EventID 2071: Firewall Rule Added](/windows-forensics/artifacts-by-type/event-log-artifacts/microsoft-windows-windows-firewall-with-advanced-security/evtx-2071-firewall-windows-11.md)
- [EventID 2073: Firewall Rule Modified](/windows-forensics/artifacts-by-type/event-log-artifacts/microsoft-windows-windows-firewall-with-advanced-security/evtx-2073-firewall-windows-11.md)
- [EventID 2052: Firewall Rule Deleted](/windows-forensics/artifacts-by-type/event-log-artifacts/microsoft-windows-windows-firewall-with-advanced-security/evtx-2052-firewall-windows-11.md)
- [TerminalServices-LocalSessionManager](/windows-forensics/artifacts-by-type/event-log-artifacts/terminalservices-localsessionmanager.md)
- [EventID 21: Session logon succeeded](/windows-forensics/artifacts-by-type/event-log-artifacts/terminalservices-localsessionmanager/terminal-services-local-21.md)
- [EventID 24: Session has been disconnected](/windows-forensics/artifacts-by-type/event-log-artifacts/terminalservices-localsessionmanager/terminal-services-local-24.md)
- [TerminalServices-RemoteConnectionManager](/windows-forensics/artifacts-by-type/event-log-artifacts/terminalservices-remoteconnectionmanager.md)
- [EventID 1149: User Authentication Succeeded](/windows-forensics/artifacts-by-type/event-log-artifacts/terminalservices-remoteconnectionmanager/terminal-services-remote-1149.md)
- [Microsoft Windows Shell Core](/windows-forensics/artifacts-by-type/event-log-artifacts/microsoft-windows-shell-core.md)
- [EventID 9707: Command Execution Started](/windows-forensics/artifacts-by-type/event-log-artifacts/microsoft-windows-shell-core/evtx-9707-shell-core.md)
- [Microsoft-Windows-PowerShell](/windows-forensics/artifacts-by-type/event-log-artifacts/microsoft-windows-powershell.md)
- [EventID 4104: PowerShell Script Block Logging](/windows-forensics/artifacts-by-type/event-log-artifacts/microsoft-windows-powershell/evtx-4104-script-block-logging.md)