Event ID: 4614

A notification package has been loaded by the Security Account Manager

A notification package has been loaded by the Security Account Manager.
This package will be notified of any account or password changes.

Notification Package Name:  %1
Microsoft Documentation

Event ID - 4614



This event generates every time a Notification Package has been loaded by the Security Account Manager.

In reality, starting with Windows Vista, a notification package should be interpreted as afs Password Filter.

Password Filters are DLLs that are loaded or called when passwords are set or changed.

Each time a system starts, it loads the notification package DLLs from HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages registry value and performs the initialization sequence for every package.



Name Field Insertion String OS Example
Notification Package Name NotificationPackageName %1 Any C:\\Windows\\system32\\msv1\_0.DLL : MICROSOFT\_AUTHENTICATION\_PACKAGE\_V1\_0


Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"Security System Extension"
How to enable Windows Auditing



LEFT/RIGHT arrow keys for navigation

Back to List