Windows Event IDs

Event ID related to Time / TimeZone Change 4616, 35, 31, 6013, 1

System Restart Related Event ID: 1074, 13, 109, 20

Login related event ID: 4624, 4625, 4634

Security Log unrelated log filter: -4703,-5158, -5156, -5154, -4622

Event ID	Meaning	Source	Folder
1074	The process C:\Windows\System32\RuntimeBroker.exe (alex-bridger) has initiated the restart of computer	User32	System
13	The operating system is shutting down at system time	Kernel-General	System
109	The kernel power manager has initiated a shutdown transition	Kernel-Power	System
20	The last shutdown's success status was true. The last boot's success status was true.	Kernel-Boot	System
4624	Successful Login	Microsoft Windows security auditing	Security
4625	Logon Failure	Microsoft Windows security auditing	Security

 

 Reference: 

Windows Security Log Event ID 4625 - An account failed to log on