1 files changed, 52 insertions, 0 deletions
diff --git a/librpc/idl/windows_event_ids.idl b/librpc/idl/windows_event_ids.idl
new file mode 100644
index 0000000..f482800
--- /dev/null
+++ b/librpc/idl/windows_event_ids.idl
@@ -0,0 +1,52 @@
+/*
+   IDL constants for windows event codes.
+*/
+
+[
+  pointer_default(unique)
+]
+interface windows_events
+{
+
+	typedef [v1_enum,public] enum {
+		EVT_ID_NONE						=    0,
+		EVT_ID_SUCCESSFUL_LOGON					= 4624,
+		EVT_ID_UNSUCCESSFUL_LOGON				= 4625,
+		EVT_ID_PASSWORD_CHANGE					= 4723,
+		EVT_ID_PASSWORD_RESET					= 4724,
+		EVT_ID_USER_ADDED_TO_GLOBAL_SEC_GROUP			= 4728,
+		EVT_ID_USER_REMOVED_FROM_GLOBAL_SEC_GROUP		= 4729,
+		EVT_ID_USER_ADDED_TO_LOCAL_SEC_GROUP			= 4732,
+		EVT_ID_USER_REMOVED_FROM_LOCAL_SEC_GROUP		= 4733,
+		EVT_ID_USER_ADDED_TO_LOCAL_GROUP			= 4746,
+		EVT_ID_USER_REMOVED_FROM_LOCAL_GROUP			= 4747,
+		EVT_ID_USER_ADDED_TO_GLOBAL_GROUP			= 4751,
+		EVT_ID_USER_REMOVED_FROM_GLOBAL_GROUP			= 4752,
+		EVT_ID_USER_ADDED_TO_UNIVERSAL_SEC_GROUP		= 4756,
+		EVT_ID_USER_REMOVED_FROM_UNIVERSAL_SEC_GROUP		= 4757,
+		EVT_ID_USER_ADDED_TO_UNIVERSAL_GROUP			= 4761,
+		EVT_ID_USER_REMOVED_FROM_UNIVERSAL_GROUP		= 4762
+	} event_id_type;
+
+	/* See https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/authentication-policies-and-authentication-policy-silos#BKMK_ErrorandEvents */
+	typedef [v1_enum,public] enum {
+		AUTH_EVT_ID_NONE					=    0,
+		AUTH_EVT_ID_NTLM_DEVICE_RESTRICTION			=  101,
+		AUTH_EVT_ID_KERBEROS_DEVICE_RESTRICTION			=  105,
+		AUTH_EVT_ID_KERBEROS_DEVICE_RESTRICTION_AUDIT		=  305,
+		AUTH_EVT_ID_KERBEROS_SERVER_RESTRICTION			=  106,
+		AUTH_EVT_ID_KERBEROS_SERVER_RESTRICTION_AUDIT		=  306
+	} auth_event_id_type;
+
+	typedef [v1_enum,public] enum {
+		EVT_LOGON_INTERACTIVE		=  2,
+		EVT_LOGON_NETWORK		=  3,
+		EVT_LOGON_BATCH			=  4,
+		EVT_LOGON_SERVICE		=  5,
+		EVT_LOGON_UNLOCK		=  7,
+		EVT_LOGON_NETWORK_CLEAR_TEXT	=  8,
+		EVT_LOGON_NEW_CREDENTIALS	=  9,
+		EVT_LOGON_REMOTE_INTERACTIVE	= 10,
+		EVT_LOGON_CACHED_INTERACTIVE	= 11
+	} event_logon_type;
+}