WinSecWiki > Security Settings > Local Policies > Audit Policy > System Events > Security State Change

Security State Change

This category tracks keys system changes such as system clock changes and the startup and shutdown of the actual system. To configure this on Server 2008 and Vista you must use auditpol. Windows 7 and Server 2008 R2 and later can use Group Policy.

Coverage on events generated by this category are currently in the Security Log Encyclopedia:

Event ID	Title
4608	Windows is starting up
4609	Windows is shutting down
4616	The system time was changed.

Back to top

 

Upcoming Webinars Identifying the Tier 0 Assets in Your Active Directory Environment is Step #1 in ITDR

Additional Resources