After installing Windows XP Service Pack 2, your Security event log records the following event on every restart:
Event Type: Success Audit
Event Source: Security
Event Category: Policy Change
Event ID: 612
Date: MM/DD/YYYY
Time: HH:MM:SS
User: NT AUTHORITY\SYSTEM
Computer: <Computer Name>
Description: Audit Policy Change:
New Policy: Success Failure
+ + Logon/Logoff
- - Object Access
- - Privilege Use
+ + Account Management
+ + Policy Change
+ + System
- - Detailed Tracking
- - Directory Service Access
+ + Account Logon
Changed By:
User Name: <Computer Name>$
Domain Name: <Domain Name>
Logon ID: (0x0,0x3E7)
Starting with Service Pack 2, Audit policy is applied every time that Windows starts, even if no changes have been made.
Posting Event ID 612 is expected behavior when you restart Windows XP SP2.
