Event ID 618

Encrypted Data Recovery Policy Changed:
 Changed By:
      User Name:    %1
      Domain Name:  %2
      Logon ID: %3
 Changes made:
 ('--' means no changes, otherwise each change is shown as:
 <ParameterName>: <new value> (<old value>))
 %4