Microsoft KB Archive/272460

= Information About Event 617 in the Security Event Log =

Article ID: 272460

Article Last Modified on 3/1/2007

-

APPLIES TO


 * Microsoft Windows 2000 Server
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows 2000 Professional Edition
 * Microsoft Windows 2000 Datacenter Server

-



This article was previously published under Q272460



SUMMARY
When the &quot;Audit policy change&quot; policy is enabled for either success or failure in the Default Domain Policy or Default Domain Controllers Policy Group Policy objects (GPO), a success event, event 617, is logged in the Windows 2000 Security log regardless of whether or not a policy change occurred.



MORE INFORMATION
The following list describes when a Security policy is propagated by default:
 * 1) Every five minutes when the domain controller's GPO is refreshed
 * 2) Every 16 hours, regardless of whether or not a policy change has occurred
 * 3) When you use the SECEDIT /RefreshPolicy machine_policy /enforce command to propagate Group Policy changes

If no policies have changed since the last update, event 617 is logged in the Security event log: Date: 8/28/2000                  Source:   Security Time: 4:10:18 PM                 Category: Policy Change Type: Success                    Event ID: 617 User: NT AUTHORITY\SYSTEM Computer: MALABO

Description: &quot;Kerberos Policy Changed:

Changed By: User Name: MALABO$ Domain Name:   INSULAR Logon ID:  (0x0,0x3E7) Changes made: ('--' means no changes, otherwise each change is shown as: : ) -- If a Security policy change has taken place after the last update, event 617 appears in the Security event log as follows: Date: 6/25/2000                  Source:   Security Time: 5:56:48 PM                 Category: Policy Change Type: Success                    Event ID: 617 User: NT AUTHORITY\SYSTEM Computer: MALABO

Description: &quot;Kerberos Policy Changed:

Changed By: User Name: MALABO$ Domain Name:   INSULAR Logon ID:  (0x0,0x3E7) Changes made: ('--' means no changes, otherwise each change is shown as: : ) KerLogoff: 0x7683cd1a01a9f8b0 (0x7683cd1a01b5f8b0);

Keywords: kbevent kbgpo kbinfo KB272460

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.