Event ID 4614
A notification package has been loaded by the Security Account ManagerA notification package has been loaded by the Security Account Manager. This package will be notified of any account or password changes. Notification Package Name: %1
This event generates every time a Notification Package has been loaded by the Security Account Manager.
In reality, starting with Windows Vista, a notification package should be interpreted as afs Password Filter.
Password Filters are DLLs that are loaded or called when passwords are set or changed.
Each time a system starts, it loads the notification package DLLs from HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages registry value and performs the initialization sequence for every package.
Microsoft Documentation
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /subcategory:"Security System Extension"
LEFT/RIGHT arrow keys for navigation
Back to List