Event ID 5467
PAStore Engine polled for changes to the Active Directory IPsec policyPAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, and found no changes to the policy. The cached copy of the Active Directory IPsec policy is no longer being used.
Event 5467 is the recovery confirmation event that follows a period of 5466 occurrences. It is logged when the PAStore Engine's scheduled AD poll successfully reaches Active Directory again, checks the current policy, and finds that no changes were made to the AD IPsec policy during the disconnection window.
Like all events in the 5463–5468 polling group, this event carries no insertion strings.
Auditing: Conditional
Enable alongside 5466 (Failure) to build a complete picture of AD connectivity gaps and their resolution.
Volume: Low
5467 appears at most once per disconnection episode , it is the single event that closes a sequence of one or more 5466 events
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /subcategory:"Filtering Platform Policy Change" LEFT/RIGHT arrow keys for navigation
Back to List