Event ID: 4614A notification package has been loaded by the Security Account Manager
A notification package has been loaded by the Security Account Manager. This package will be notified of any account or password changes. Notification Package Name: %1
This event generates every time a Notification Package has been loaded by the Security Account Manager.
In reality, starting with Windows Vista, a notification package should be interpreted as afs Password Filter.
Password Filters are DLLs that are loaded or called when passwords are set or changed.
Each time a system starts, it loads the notification package DLLs from HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages registry value and performs the initialization sequence for every package.
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /subcategory:"Security System Extension"
LEFT/RIGHT arrow keys for navigationBack to List