WinSecWiki > Security Settings > Local Policies > Audit Policy > System Events > Security State Change
Security State Change
This category tracks keys system changes such as system clock changes and the startup and shutdown of the actual system. To configure this on Server 2008 and Vista you must use auditpol. Windows 7 and Server 2008 R2 and later can use Group Policy.
Coverage on events generated by this category are currently in the Security Log Encyclopedia:
Back to top