Windows Security Log Event ID 611

Operating Systems Windows Server 2000
Windows 2003 and XP
CategoryPolicy Change
Type Success
Corresponding events
in Windows 2008
and Vista
4707  
Discussions on Event ID 611
Ask a question about this event

611: Removing Trusted Domain

On this page

This event varies depending on the OS.

Win2000

This event gets logged twice (duplicate) by the domain controller. Unlike event 610, an event 620 does not accompany this event.

The DC logs this event for both trusted and trusting domains. There is no way to make a distinction.

If directory service access auditing is turned on, the DC also logs an event 565 (object opened) and 564 (object deleted) where the object service is LSA and the object type is TrustedDomainObject. Object name identifies the 610, 611 and 620

Win2003

Unlike Windows 2000, Windows Server 2003 only logs this event once for each new domain. Although the description says "new *trusted* domain" this event gets logged for both trusted and trusting relationships.

If directory service access auditing is turned on, the DC also logs an event 565 (object opened) and 564 (object deleted) where the object service is LSA and the object type is TrustedDomainObject. Object name identifies the domain.
See also event IDs 610 and 620.

Free Security Log Resources by Randy

Description Fields in 611

  • Trusted Domain Removed: (Windows 2000 says "Removing Trusted Domain")
  • Domain Name:
  • Domain ID:
  • Removed By:
  • User Name:
  • Domain: (domain of the user that removed the trust)
  • Logon ID:

Supercharger Free Edition


Supercharger's built-in Xpath filters leave the noise behind.

Free.

 

Examples of 611

Win2000

Removing Trusted Domain:
Domain Name:Europe
Domain ID:-
Removed By:
User Name:administrator
Domain:ELMW2
Logon ID:(0x0,0x804C2)

Win2003

Trusted Domain Removed:
Domain Name:SouthAmerica
Domain ID:-
Removed By:
User Name:administrator
Domain:ELM
Logon ID:(0x0,0x158EB7)

Keep me up-to-date on the Windows Security Log.
Email*:
*We will NOT share this

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection



 

Additional Resources