/*
   IDL constants for windows event codes.
*/

[
  pointer_default(unique)
]
interface windows_events
{

	typedef [v1_enum,public] enum {
		EVT_ID_NONE						=    0,
		EVT_ID_SUCCESSFUL_LOGON					= 4624,
		EVT_ID_UNSUCCESSFUL_LOGON				= 4625,
		EVT_ID_PASSWORD_CHANGE					= 4723,
		EVT_ID_PASSWORD_RESET					= 4724,
		EVT_ID_USER_ADDED_TO_GLOBAL_SEC_GROUP			= 4728,
		EVT_ID_USER_REMOVED_FROM_GLOBAL_SEC_GROUP		= 4729,
		EVT_ID_USER_ADDED_TO_LOCAL_SEC_GROUP			= 4732,
		EVT_ID_USER_REMOVED_FROM_LOCAL_SEC_GROUP		= 4733,
		EVT_ID_USER_ADDED_TO_LOCAL_GROUP			= 4746,
		EVT_ID_USER_REMOVED_FROM_LOCAL_GROUP			= 4747,
		EVT_ID_USER_ADDED_TO_GLOBAL_GROUP			= 4751,
		EVT_ID_USER_REMOVED_FROM_GLOBAL_GROUP			= 4752,
		EVT_ID_USER_ADDED_TO_UNIVERSAL_SEC_GROUP		= 4756,
		EVT_ID_USER_REMOVED_FROM_UNIVERSAL_SEC_GROUP		= 4757,
		EVT_ID_USER_ADDED_TO_UNIVERSAL_GROUP			= 4761,
		EVT_ID_USER_REMOVED_FROM_UNIVERSAL_GROUP		= 4762
	} event_id_type;

	/* See https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/authentication-policies-and-authentication-policy-silos#BKMK_ErrorandEvents */
	typedef [v1_enum,public] enum {
		AUTH_EVT_ID_NONE					=    0,
		AUTH_EVT_ID_NTLM_DEVICE_RESTRICTION			=  101,
		AUTH_EVT_ID_KERBEROS_DEVICE_RESTRICTION			=  105,
		AUTH_EVT_ID_KERBEROS_DEVICE_RESTRICTION_AUDIT		=  305,
		AUTH_EVT_ID_KERBEROS_SERVER_RESTRICTION			=  106,
		AUTH_EVT_ID_KERBEROS_SERVER_RESTRICTION_AUDIT		=  306
	} auth_event_id_type;

	typedef [v1_enum,public] enum {
		EVT_LOGON_INTERACTIVE		=  2,
		EVT_LOGON_NETWORK		=  3,
		EVT_LOGON_BATCH			=  4,
		EVT_LOGON_SERVICE		=  5,
		EVT_LOGON_UNLOCK		=  7,
		EVT_LOGON_NETWORK_CLEAR_TEXT	=  8,
		EVT_LOGON_NEW_CREDENTIALS	=  9,
		EVT_LOGON_REMOTE_INTERACTIVE	= 10,
		EVT_LOGON_CACHED_INTERACTIVE	= 11
	} event_logon_type;
}