I listened to a SANS “Ask The Expert” webcast today entitled "Who's Guarding the Guards?" featuring Dave Shackleford and Kristin Gallina Lovejoy. The webcast was quite informative and Dave Shackleford gave an excellent presentation, as always. At the end of Dave's presentation he offered a number of additional resources. One was a link to Randy Franklin Smith's Windows Security Log Encyclopedia, plain English explanations of Windows security log events listed by Category or Event ID.