Security Events You Can Safely Ignore

Well as a System Administrator you browse through literal 100.000 event logs every week.
Below you will find a list posted by Microsoft. This list tells you which events you can safely ignore.

This will make your life a bit easier.... (I hope)

 

You can find the original document here

 

Event IDs	Occurrence	Comments
538	User logoff	This event does not necessarily indicate the time that the user stopped using the computer. For example, if the user turns the computer off without first logging off, or if the network connection to a share breaks, the computer might not record a logoff at all, or might record a logoff only when the computer notices that the connection is broken.
551	User initiates logoff	Use Event 538, which confirms logoff instead.
562	A handle to an object closed	Always records a success.
571	Client Context deleted by Authorization Manager.	Normal where Authorization Manager is in use.
573	Process generates nonsystem audit event with Authorization Application Programming Interface (AuthZ API)	Typical behavior.
577 578	Privilege service called, privileged object operation	These high volume events typically do not contain enough information either to understand what happened or to act upon them.
594	A handle to an object was duplicated	Typical behavior.
595	Indirect access to an object was obtained	Typical behavior.
596	Backup of data protection master key	Occurs automatically every 90 days with default settings.
597	Recovery of data protection master key	Typical behavior.
624 642	Event 624 where User equals System, followed by 642 where Target Account Name equals IUSR_machinename or IWAM_machinename and Caller User Name equals machinename$ .	This event sequence indicates that an administrator has installed IIS on the computer.
624 630 642	User equals System and all three events have same time-stamp and New/Target Account Name equals HelpAssistant and Caller User Name equals DCname$	This sequence is generated when an administrator installs Active Directory on a computer that runs Windows Server 2003.
624 or 642	User equals ExchangeServername$ and Target Account Name is a Globally Unique Identifier (GUID)	This event occurs when an Exchange Server first comes online and automatically generates system mailboxes.
624	Caller User Name is any user and New Account Name is machinename$	A user in the domain has created or connected a new computer account in the domain. This event is acceptable if users have the right to join computers to a domain; otherwise you should investigate this event.
627	User equals System and Target Account Name equals TsInternetUser and Caller User Name is usually DCname$	These events result from the normal behavior of a computer that runs Terminal Services.
672	Kerberos AS Ticket request	If you collect logon events 528 and 540 from all computers, event 672 might not contain any additional useful information, as it just records that a Kerberos TGT was granted. There must still be a service ticket granted (event 673) for any access to occur.
680	Account Logon	If you collecting logon events 528 and 540 from all computers, event 680 might not contain any additional useful information, because it just records validation of the account credentials. A separate logon event records what the user accessed.
697	Password policy checking API called	Typical behavior.
768	Forest namespace collision	Not security related.
769 770 771	Trusted forest information added, deleted or modified	These events indicate normal operation of inter-forest trusts. You should not confuse these with addition, deletion, or modification of the trust itself.
832 to 841	Various Active Directory replication issues	No security implications.