Event ID 612 appears in the security log every time that you restart Windows XP Service Pack 2 (840633)
The information in this article applies to:
- Microsoft Windows XP Home Edition Service Pack 2 (SP2)
- Microsoft Windows XP Professional Service Pack 2 (SP2)
SYMPTOMSAfter you install Microsoft Windows XP Service Pack 2 (SP2), you may receive the following event message in the security log in Event Viewer every time that you restart the computer: Event Type: Success Audit
Event Source: Security
Event Category: Policy Change
Event ID: 612
Date: date
Time: time
User: NT AUTHORITY\SYSTEM
Computer: computername
Description:
Audit Policy Change:
New Policy:
Success Failure
+ + Logon/Logoff
- - Object Access
- - Privilege Use
+ + Account Management
+ + Policy Change
+ + System
- - Detailed Tracking
- - Directory Service Access
+ + Account Logon
Changed By:
User Name: computername$
Domain Name: DOMAIN
Logon ID: (0x0,0x3E7)
CAUSEEvent ID 612 indicates that a change in audit policy has been made on the local computer. The logging of Event ID 612 is the expected behavior when you restart Windows XP SP2.
MORE INFORMATIONIn Windows XP SP2, a change was made to the way audit policy is applied. Audit policy is now applied every time Windows starts. This behavior occurs regardless of whether there have been any changes to the audit policy.
In earlier versions of Windows XP, the audit policy was applied when Windows restarted only if Windows detected a change in policy. This change helps make sure that Windows detects and logs a change in policy every time an administrator changes your audit policy.
| Modification Type: | Major | Last Reviewed: | 4/7/2006 |
|---|
| Keywords: | kbQFE KBHotfixServer kberrmsg kbBug kbtshoot kbEventLog kbenv kbprb KB840633 kbAudEndUser kbAudITPRO kbAudOEM |
|---|
|