Microsoft KB Archive/840633

= Event ID 612 appears in the security log every time that you restart Windows XP Service Pack 2 =

Article ID: 840633

Article Last Modified on 4/7/2006

-

APPLIES TO


 * Microsoft Windows XP Service Pack 2
 * Microsoft Windows XP Service Pack 2

-





SYMPTOMS
After you install Microsoft Windows XP Service Pack 2 (SP2), you may receive the following event message in the security log in Event Viewer every time that you restart the computer: Event Type: Success Audit

Event Source: Security

Event Category: Policy Change

Event ID: 612

Date:

Time:

User: NT AUTHORITY\SYSTEM

Computer:

Description: Audit Policy Change:

New Policy: Success Failure

+ + Logon/Logoff

- - Object Access

- - Privilege Use

+ + Account Management

+ + Policy Change

+ + System

- - Detailed Tracking

- - Directory Service Access

+ + Account Logon

Changed By:

User Name: $

Domain Name:

Logon ID: (0x0,0x3E7)



CAUSE
Event ID 612 indicates that a change in audit policy has been made on the local computer. The logging of Event ID 612 is the expected behavior when you restart Windows XP SP2.



MORE INFORMATION
In Windows XP SP2, a change was made to the way audit policy is applied. Audit policy is now applied every time Windows starts. This behavior occurs regardless of whether there have been any changes to the audit policy. In earlier versions of Windows XP, the audit policy was applied when Windows restarted only if Windows detected a change in policy. This change helps make sure that Windows detects and logs a change in policy every time an administrator changes your audit policy.

Additional query words: winxpsp2 xpsp2

Keywords: kbqfe kbhotfixserver kberrmsg kbbug kbtshoot kbeventlog kbenv kbprb KB840633

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.