Information About Event 617 in the Security Event Log

This article was previously published under Q272460
This article has been archived. It is offered "as is" and will no longer be updated.
SUMMARY
When the "Audit policy change" policy is enabled for either success or failure in the Default Domain Policy or Default Domain Controllers Policy Group Policy objects (GPO), a success event, event 617, is logged in the Windows 2000 Security log regardless of whether or not a policy change occurred.
MORE INFORMATION
The following list describes when a Security policy is propagated by default:
  1. Every five minutes when the domain controller's GPO is refreshed
  2. Every 16 hours, regardless of whether or not a policy change has occurred
  3. When you use the SECEDIT /RefreshPolicy machine_policy /enforce command to propagate Group Policy changes
If no policies have changed since the last update, event 617 is logged in the Security event log:
Date: 8/28/2000                   Source:   SecurityTime: 4:10:18 PM                  Category: Policy ChangeType: Success                     Event ID: 617User: NT AUTHORITY\SYSTEMComputer: MALABODescription:"Kerberos Policy Changed:Changed By: 	User Name:	MALABO$ 	Domain Name:	INSULAR 	Logon ID:	(0x0,0x3E7)Changes made:('--' means no changes, otherwise each change is shown as:<ParameterName>: <new value> (<old value>))--				
If a Security policy change has taken place after the last update, event 617 appears in the Security event log as follows:
Date: 6/25/2000                   Source:   SecurityTime: 5:56:48 PM                  Category: Policy ChangeType: Success                     Event ID: 617User: NT AUTHORITY\SYSTEMComputer: MALABODescription:"Kerberos Policy Changed:Changed By: 	User Name:	MALABO$ 	Domain Name:	INSULAR 	Logon ID:	(0x0,0x3E7)Changes made:('--' means no changes, otherwise each change is shown as:<ParameterName>: <new value> (<old value>))KerLogoff: 0x7683cd1a01a9f8b0 (0x7683cd1a01b5f8b0); 				
Properties

Article ID: 272460 - Last Review: 10/21/2013 00:59:16 - Revision: 3.2

  • Microsoft Windows 2000 Server
  • Microsoft Windows 2000 Advanced Server
  • Microsoft Windows 2000 Professional Edition
  • Microsoft Windows 2000 Datacenter Server
  • kbnosurvey kbarchive kbevent kbgpo kbinfo KB272460
Feedback