Event ID 5464
PAStore Engine polled for changes to the active IPsec policy, detected changes, and applied them to IPsec ServicesPAStore Engine polled for changes to the active IPsec policy, detected changes, and applied them to IPsec Services.
Event 5464 is the change-detected counterpart to the no-change polling event 5463. It is logged when the PAStore Engine's routine polling cycle finds that the active IPsec policy has been updated since the last poll and successfully applies the new version to the local IPsec stack.
Like 5463, this event carries no insertion strings — the message is fully static.
Auditing: Conditional
Enable in environments where IPsec policy changes should be tracked as part of change management or compliance.
Volume: Low
Unlike 5463 which is logged at every polling interval, 5464 only occurs when the IPsec policy actually changes between polling cycles.
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /subcategory:"Filtering Platform Policy Change" LEFT/RIGHT arrow keys for navigation
Back to List