Windows Security Event Log contains records of login/logout activity or other security- related events specified by the system's audit policy. What does event ID 531 in Windows Security Event Log…

The correct answer is D. A logon attempt was made using a disabled account. Windows Security Event Log uses specific event IDs to categorize logon events (applicable to legacy Windows systems pre-Vista). The key logon event IDs are: 528 = Successful logon, 529 = Unknown username or bad password, 530 = Logon attempt outside allowed time, 531 = Logon…

Submitted by javi_es· Apr 18, 2026Computer Forensics Investigation Process

Question

Windows Security Event Log contains records of login/logout activity or other security- related events specified by the system's audit policy. What does event ID 531 in Windows Security Event Log indicates?

Options

AA user successfully logged on to a computer
BThe logon attempt was made with an unknown user name or a known user name with a bad
CAn attempt was made to log on with the user account outside of the allowed time
DA logon attempt was made using a disabled account

How the community answered

(29 responses)

A
3% (1)
B
3% (1)
D
93% (27)

Explanation

Windows Security Event Log uses specific event IDs to categorize logon events (applicable to legacy Windows systems pre-Vista). The key logon event IDs are: 528 = Successful logon, 529 = Unknown username or bad password, 530 = Logon attempt outside allowed time, 531 = Logon attempt using a disabled account, 532 = Logon attempt using an expired account, 533 = Logon attempt from an unauthorized workstation. Event ID 531 specifically indicates that someone attempted to log on using an account that has been disabled by an administrator.

Topics

#Windows Security Event Log#Event ID 531#Logon failures#Security auditing

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice