After you install Microsoft Windows XP Service Pack 2 (SP2) or Windows Server 2003 SP2, you may receive the following event message in the security log in Event Viewer every time that you restart the computer:
Event Type: Success Audit Event Source: Security Event Category: Policy Change Event ID: 612 Date: date Time: time User: NT AUTHORITY\SYSTEM Computer: computername Description:Audit Policy Change: New Policy: Success Failure + + Logon/Logoff - - Object Access - - Privilege Use + + Account Management + + Policy Change + + System - - Detailed Tracking - - Directory Service Access + + Account Logon
Event ID 612 indicates that a change in audit policy has been made on the local computer. The logging of Event ID 612 is the expected behavior when you restart Windows XP SP2.
In Windows XP SP2 and in Windows Server 2003 SP2, a change was made to the way audit policy is applied. Audit policy is now applied every time Windows starts. This behavior occurs regardless of whether there have been any changes to the audit policy. In earlier versions of Windows XP and of Windows Server 2003, the audit policy was applied when Windows restarted only if Windows detected a change in policy. This change helps make sure that Windows detects and logs a change in policy every time an administrator changes your audit policy.