Windows Security Log Event ID 518

Operating Systems Windows Server 2000
Windows 2003 and XP
CategorySystem
Type Success
Corresponding events
in Windows 2008
and Vista
4614  
Discussions on Event ID 518
Ask a question about this event

518: A notification package has been loaded by the Security Account Manager

On this page

An occurrence of Event 518 is logged for each notification package on the system.

Notification packages are DLLs that Windows calls into whenenever a user changes his/her password. The purpose of a notification package is to let you evaluate passwords against your own rules for acceptability. The notification package answers back whether or not the password is acceptable. Notification packages are also used to implement password synchronization systems.

A rogue notification package would be a devastating security breach because notification packages are supplied with the clear text of the password and are simpler to write and install than authentication packages and logon processes (see event 514 and event 515).

Standard notification packages for Windows server 2003: 

  • scecli
  • RASSFM
  • WDIGEST
  • KDCSVC

Free Security Log Resources by Randy

Description Fields in 518

  • Notification Package Name: name of the package

Supercharger Free Edition

 

Examples of 518

An notification package has been loaded by the Security Account Manager. This package will be notified of any account or password changes.
Notification Package Name: scecli

Keep me up-to-date on the Windows Security Log.
Email*:
*We will NOT share this

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection



 

Upcoming Webinars
    Additional Resources