Windows Security Log Event ID 4614

Operating Systems Windows 2008 R2 and 7
Windows 2012 R2 and 8.1
Windows 2016 and 10
Windows Server 2019 and 2022
Category
 • Subcategory		System
 • Security System Extension
Type Success
Corresponding events
in Windows 2003
and before		 518  

4614: A notification package has been loaded by the Security Account Manager.

On this page

An occurrence of Event 4614 is logged for each notification package on the system.

Notification packages are DLLs that Windows calls into whenenever a user changes his/her password. The purpose of a notification package is to let you evaluate passwords against your own rules for acceptability. The notification package answers back whether or not the password is acceptable. Notification packages are also used to implement password synchronization systems.

A rogue notification package would be a devastating security breach because notification packages are supplied with the clear text of the password and are simpler to write and install than authentication packages and logon processes (see 4610, 4611, and 4622).

Standard notification packages for Windows server 2008:

  • scecli
  • RASSFM
  • WDIGEST
  • KDCSVC

Free Security Log Resources by Randy

Description Fields in 4614

  • Notification Package Name: %1

Supercharger Enterprise


 

Examples of 4614

A notification package has been loaded by the Security Account Manager.
This package will be notified of any account or password changes.

Notification Package Name: RASSFM

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection

 

Upcoming Webinars
    Additional Resources