Information About Event 617 in the Security Event Log

Article translations Article translations
Article ID: 272460 - View products that this article applies to.
This article was previously published under Q272460
This article has been archived. It is offered "as is" and will no longer be updated.
Expand all | Collapse all

SUMMARY

When the "Audit policy change" policy is enabled for either success or failure in the Default Domain Policy or Default Domain Controllers Policy Group Policy objects (GPO), a success event, event 617, is logged in the Windows 2000 Security log regardless of whether or not a policy change occurred.

MORE INFORMATION

The following list describes when a Security policy is propagated by default:
  1. Every five minutes when the domain controller's GPO is refreshed
  2. Every 16 hours, regardless of whether or not a policy change has occurred
  3. When you use the SECEDIT /RefreshPolicy machine_policy /enforce command to propagate Group Policy changes
If no policies have changed since the last update, event 617 is logged in the Security event log:
Date: 8/28/2000                   Source:   Security
Time: 4:10:18 PM                  Category: Policy Change
Type: Success                     Event ID: 617
User: NT AUTHORITY\SYSTEM
Computer: MALABO

Description:
"Kerberos Policy Changed:

Changed By:
 	User Name:	MALABO$
 	Domain Name:	INSULAR
 	Logon ID:	(0x0,0x3E7)
Changes made:
('--' means no changes, otherwise each change is shown as:
<ParameterName>: <new value> (<old value>))
--
				
If a Security policy change has taken place after the last update, event 617 appears in the Security event log as follows:
Date: 6/25/2000                   Source:   Security
Time: 5:56:48 PM                  Category: Policy Change
Type: Success                     Event ID: 617
User: NT AUTHORITY\SYSTEM
Computer: MALABO

Description:
"Kerberos Policy Changed:

Changed By:
 	User Name:	MALABO$
 	Domain Name:	INSULAR
 	Logon ID:	(0x0,0x3E7)
Changes made:
('--' means no changes, otherwise each change is shown as:
<ParameterName>: <new value> (<old value>))
KerLogoff: 0x7683cd1a01a9f8b0 (0x7683cd1a01b5f8b0); 
				

Properties

Article ID: 272460 - Last Review: October 21, 2013 - Revision: 3.2
APPLIES TO
  • Microsoft Windows 2000 Server
  • Microsoft Windows 2000 Advanced Server
  • Microsoft Windows 2000 Professional Edition
  • Microsoft Windows 2000 Datacenter Server
Keywords: 
kbnosurvey kbarchive kbevent kbgpo kbinfo KB272460

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com