JSI Tip 10401. Every time you restart Windows XP SP2, Event 612 is posted to the Security log?

After installing Windows XP Service Pack 2, your Security event log records the following event on every restart:

Event Type: Success Audit
Event Source: Security
Event Category: Policy Change
Event ID: 612
Time: HH:MM:SS
Computer: <Computer Name>
Description: Audit Policy Change:
New Policy: Success Failure
+ + Logon/Logoff
- - Object Access
- - Privilege Use
+ + Account Management
+ + Policy Change
+ + System
- - Detailed Tracking
- - Directory Service Access
+ + Account Logon

Changed By:
User Name: <Computer Name>$
Domain Name: <Domain Name>
Logon ID: (0x0,0x3E7)

Starting with Service Pack 2, Audit policy is applied every time that Windows starts, even if no changes have been made.

Posting Event ID 612 is expected behavior when you restart Windows XP SP2.

Hide comments


  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.