| Microsoft-Windows-MultiPoint-Server | 1000 | Info | MultiPoint Services initialized successfully |
| Microsoft-Windows-MultiPoint-Server | 1001 | High | MultiPoint Services stopped or crashed |
| Microsoft-Windows-MultiPoint-Server | 1003 | Critical | Service configuration file corrupted |
| System | 7040 | Medium | MultiPoint Service startup type changed |
| Microsoft-Windows-MultiPoint-Server | 2000 | Info | New MultiPoint user session created |
| Microsoft-Windows-MultiPoint-Server | 2001 | Info | User session ended normally |
| Microsoft-Windows-MultiPoint-Server | 2003 | High | User disconnected unexpectedly |
| Microsoft-Windows-MultiPoint-Server | 2004 | Medium | Concurrent session threshold exceeded |
| Security | 4624 | Info | Successful interactive logon to MultiPoint station |
| Security | 4625 | High | Failed logon attempt at MultiPoint station |
| Microsoft-Windows-MultiPoint-Server | 3001 | Medium | New USB device attached to station |
| Microsoft-Windows-MultiPoint-Server | 3002 | Info | USB device blocked by policy |
| Microsoft-Windows-MultiPoint-Server | 3003 | Info | Display or input device disconnected |
| Microsoft-Windows-MultiPoint-Server | 3005 | Info | Printer access requested |
| Microsoft-Windows-MultiPoint-Server | 3006 | High | Unauthorized device access attempt |
| Microsoft-Windows-MultiPoint-Server | 4001 | Info | Station powered ON |
| Microsoft-Windows-MultiPoint-Server | 4002 | Info | Station powered OFF |
| Microsoft-Windows-MultiPoint-Server | 4003 | High | Station performance degradation detected |
| Microsoft-Windows-MultiPoint-Server | 4004 | Medium | Network latency affecting session response |
| Microsoft-Windows-MultiPoint-Server | 4005 | Info | Station disconnected due to idle timeout |
| Microsoft-Windows-MultiPoint-Server | 5000 | Info | MultiPoint license activated |
| Microsoft-Windows-MultiPoint-Server | 5001 | High | License validation failed |
| Microsoft-Windows-MultiPoint-Server | 5003 | Critical | Session count exceeds license |
| Security | 4719 | High | System audit policy changed |
| Security | 4732 | High | User added to MultiPoint administrators group |
| Security | 4733 | Info | User removed from MultiPoint administrators group |
| Microsoft-Windows-MultiPoint-Server | 6001 | Critical | Unauthorized configuration attempt detected |
| Microsoft-Windows-MultiPoint-Server | 6002 | High | Security policy enforcement failed |