WinSecWiki > Security Settings > Advanced Audit Policies > System > Security State Change

Audit Security State Change

This category tracks keys system changes such as system clock changes and the startup and shutdown of the actual system. To configure this on Server 2008 and Vista you must use auditpol. Windows 7 and Server 2008 R2 and later can use Group Policy.

Coverage on events generated by this category are currently in the Security Log Encyclopedia:

Event ID	Title
4608	Windows is starting up
4609	Windows is shutting down
4616	The system time was changed.

Back to top

 

Upcoming Webinars Live, Hands-on Deep-Dive into LLM Hacking: Prompt Injection, Model Context Protocol and Skills AD Certificate Services: A Massive Chunk of Windows Security Functionality Finally Gets the Security Research It Deserves Linux Security: Locking Down Admin Access with SSH and Sudo Understanding Broken Object Level Authorization: The Quiet Access Control Failure Undermining Today’s Apps Patching 3rd Party Apps on PCs Managed by Intune

Additional Resources