• 104 — Event log was cleared
• 1102 — Audit log was cleared (517 on Windows 2003 and earlier)
• 4104 — PowerShell command and script logging
• 4626 — Successful logon
  • LogonType 3 represents a (generic) network login
  • LogonType 9 represents a logon where the outbound credentials are different than the credentials used to authenticate to the account that is initiating that login (only logged by the host initiating the connection, however)

It’s hard to find documentation about event ID, and the meaning seems to shift between versions of Windows.