Event ID: 618

Encrypted Data Recovery Policy Changed

Encrypted Data Recovery Policy Changed:
 Changed By:
      User Name:    %1
      Domain Name:  %2
      Logon ID: %3
 Changes made:
 ('--' means no changes, otherwise each change is shown as:
 <ParameterName>: <new value> (<old value>))

Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /category:"Policy Change"
How to enable Windows Auditing

Operating Systems:
Windows 2003 Windows XP

Audit Category:
Policy Change
Corresponding Events:

LEFT/RIGHT arrow keys for navigation

Back to List