System Event Messages

The following messages document local system processes such as system startup and shutdown and changes to the system time or audit log.

512 Windows is starting up.

Parameters: None.

Configurable Information: Success

Formal name: SE_AUDITID_SYSTEM_RESTART

513 Windows is shutting down.

Parameters: None.

Configurable Information: Success

Formal name: SE_AUDITID_SYSTEM_SHUTDOWN

514 An authentication package was loaded by the Local Security Authority.

Parameters: Authentication package name.

Configurable Information: Success

Formal name: SE_AUDITID_AUTH_PACKAGE_LOAD

515 A trusted logon process has registered with the Local Security Authority.

Parameters: Logon process name.

Configurable Information: Success

Formal name: SE_AUDITID_SYSTEM_LOGON_PROC_REGISTER

516 Internal resources allocated for the queuing of security event messages have been exhausted, leading to the loss of some security event messages.

Parameters: Number of audit messages discarded.

Configurable Information: Success

Formal name: SE_AUDITID_AUDITS_DISCARDED

517 The audit log was cleared.

Parameters: Primary user name, primary domain, primary logon ID, client user name, client domain, client logon ID

Configurable Information: Success

Formal name: SE_AUDITID_AUDIT_LOG_CLEARED

518 A notification package was loaded by the Security Accounts Manager.

Parameter: Notification package name.

Configurable Information: Success

Formal name: SE_AUDITID_NOTIFY_PACKAGE_LOAD

519 A process is using an invalid local procedure call (LPC) port in an attempt to impersonate a client and reply or read from or write to a client address space.

Parameters: Process ID, type of invalid use (either impersonation or reply), server port name, primary user name, primary domain, primary logon ID, client user name, client domain, client logon ID.

Configurable Information: Success

Formal name: SE_AUDITID_LPC_INVALID_USE

520 The system time was changed.

Parameters: Process ID, process name, primary user name, primary domain, primary logon ID, client user name, client domain, client logon ID, previous time, new time.

Configurable Information: Success

Formal name: SE_AUDITID_SYSTEM_TIME_CHANGE

This audit normally appears twice. This is necessary to deal with time zone changes.