Contains events reported by various applications installed on the Windows server. These can be Microsoft or 3-rd party applications
%SystemRoot%\System32\Config\AppEvent.evt
Contains all the auditing and security events.
%SystemRoot%\System32\Config\SecEvent.evt
Contains events reported by Windows system components (processes, kernel, drivers.
%SystemRoot%\System32\Config\SysEvent.evt
Contains events reported by Active Directory
%SystemRoot%\System32\Config\Director.evt
Contains events reported by Microsoft Windows DNS Server.
%SystemRoot%\System32\Config\DNSEvent.evt
Contains events reported by Microsoft FRS Service.
%SystemRoot%\System32\Config\NTFrs.evt
Note: Win2K Professional, XP or Vista cannot read any of the DNS/FRS/DS logs, unless the Admin pack is installed.