WinSecWiki > Security Settings > Local Policies > Audit Policy > System Events > Security State Change

Security State Change

This category tracks keys system changes such as system clock changes and the startup and shutdown of the actual system. To configure this on Server 2008 and Vista you must use auditpol. Windows 7 and Server 2008 R2 and later can use Group Policy.

Coverage on events generated by this category are currently in the Security Log Encyclopedia:

Event IDTitle
4608 Windows is starting up
4609 Windows is shutting down
4616 The system time was changed.

Back to top


Additional Resources