Event ID 612 appears in the security log every time that you restart Windows Server 2003 with Service Pack 2 or Windows XP with Service Pack 2

After you install Microsoft Windows XP Service Pack 2 (SP2) or Windows Server 2003 SP2, you may receive the following event message in the security log in Event Viewer every time that you restart the computer:

Event Type: Success Audit
Event Source: Security
Event Category: Policy Change
Event ID: 612
Date: date
Time: time
User: NT AUTHORITY\SYSTEM
Computer: computername
Description: Audit Policy Change:
New Policy: Success Failure
+ + Logon/Logoff
- - Object Access
- - Privilege Use
+ + Account Management
+ + Policy Change
+ + System
- - Detailed Tracking
- - Directory Service Access
+ + Account Logon

Changed By:
User Name: computername$
Domain Name: DOMAIN
Logon ID: (0x0,0x3E7)

Event ID 612 indicates that a change in audit policy has been made on the local computer. The logging of Event ID 612 is the expected behavior when you restart Windows XP SP2.

In Windows XP SP2 and in Windows Server 2003 SP2, a change was made to the way audit policy is applied. Audit policy is now applied every time Windows starts. This behavior occurs regardless of whether there have been any changes to the audit policy. In earlier versions of Windows XP and of Windows Server 2003, the audit policy was applied when Windows restarted only if Windows detected a change in policy. This change helps make sure that Windows detects and logs a change in policy every time an administrator changes your audit policy.