Audit Other Policy Change Events

Applies To: Windows 7, Windows Server 2008 R2

This security policy setting determines whether the operating system generates events for security policy changes that are not otherwise audited in the Policy Change category, such as the following:

• Trusted Platform Module (TPM) configuration changes.

• Kernel-mode cryptographic self tests.

• Cryptographic provider operations.

• Cryptographic context operations or modifications.

Event volume: Low

Default: Not configured

If this policy setting is configured, the following events are generated. The events appear on computers running Windows Server 2008 R2, Windows Server 2008, Windows 7, or Windows Vista.

Event ID	Event message
4670	Permissions on an object were changed.
4909	The local policy settings for the TBS were changed.
4910	The group policy settings for the TBS were changed.
5063	A cryptographic provider operation was attempted.
5064	A cryptographic context operation was attempted.
5065	A cryptographic context modification was attempted.
5066	A cryptographic function operation was attempted.
5067	A cryptographic function modification was attempted.
5068	A cryptographic function provider operation was attempted.
5069	A cryptographic function property operation was attempted.
5070	A cryptographic function property modification was attempted.
5447	A Windows Filtering Platform filter has been changed.
6144	Security policy in the group policy objects has been applied successfully.
6145	One or more errors occurred while processing security policy in the group policy objects.