Some interesting event

System eventlog
Print event

	10	Document was printed on.
	11	Document was paused on.
	12	Document was resumed on.
	13	Document was deleted on.
	18	Document was timed out on.

Security eventlog
Windows NT starting up/down

	512	Windows NT is starting up
	513	Windows NT is shutting down. All logon sessions will be terminated by this shutdown.

Logon

	529	Logon Failure, Reason: Unknown user name or bad password.
	530	Logon Failure, Reason: Account logon time restriction violation.
	531	Logon Failure, Reason: Account currently disabled.
	532	Logon Failure, Reason: The specified user account has expired.
	533	Logon Failure, Reason: User not allowed to logon at this computer.
	535	Logon Failure, Reason: User not allowed to logon at this computer.
	536	Logon Failure, Reason: The NetLogon component is not active.
	537	Logon Failure, Reason: An unexpected error occurred during logon.
	538	User Logoff.

Process

	560	Object Open.
	562	Handle Closed.
	576	Special privileges assigned to new logon
	592	A new process has been created.
	539	A process has exited.
	594	A handle to an object has been duplicated.