Information About Event 617 in the Security Event Log (272460)

MORE INFORMATION

The following list describes when a Security policy is propagated by default:

1. Every five minutes when the domain controller's GPO is refreshed
2. Every 16 hours, regardless of whether or not a policy change has occurred
3. When you use the SECEDIT /RefreshPolicy machine_policy /enforce command to propagate Group Policy changes

If no policies have changed since the last update, event 617 is logged in the Security event log:

Date: 8/28/2000                   Source:   Security
Time: 4:10:18 PM                  Category: Policy Change
Type: Success                     Event ID: 617
User: NT AUTHORITY\SYSTEM
Computer: MALABO

Description:
"Kerberos Policy Changed:

Changed By:
 	User Name:	MALABO$
 	Domain Name:	INSULAR
 	Logon ID:	(0x0,0x3E7)
Changes made:
('--' means no changes, otherwise each change is shown as:
<ParameterName>: <new value> (<old value>))
--
				

If a Security policy change has taken place after the last update, event 617 appears in the Security event log as follows:

Date: 6/25/2000                   Source:   Security
Time: 5:56:48 PM                  Category: Policy Change
Type: Success                     Event ID: 617
User: NT AUTHORITY\SYSTEM
Computer: MALABO

Description:
"Kerberos Policy Changed:

Changed By:
 	User Name:	MALABO$
 	Domain Name:	INSULAR
 	Logon ID:	(0x0,0x3E7)
Changes made:
('--' means no changes, otherwise each change is shown as:
<ParameterName>: <new value> (<old value>))
KerLogoff: 0x7683cd1a01a9f8b0 (0x7683cd1a01b5f8b0);