Event ID: 609

User Right Removed 

User Right Removed:
    User Right:     %1
    Removed From:   %2
    Removed By:
      User Name:    %3
      Domain:       %4
      Logon ID:     %5

Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /category:"Policy Change"
How to enable Windows Auditing
Recommended Audit Policy

Operating Systems:
Windows 2003 Windows XP

Audit Category:
Policy Change
Corresponding Events:
4705

LEFT/RIGHT arrow keys for navigation

Back to List