per user audit policy

General Topics
1

what is it?

i did look on google but found it no help

jen :slight_smile:

2

I don’t understand the question.

3

Neither do I… can you rephrase?

4

in events

one of the events say

per user audit policy was refreshed event id 806

anyone no what this means???

5

I certainly haven’t come across this before, not sure what you did a google search on, this one returns many hits, http://www.google.co.uk/search?q=per+user+audit+policy+was+refreshed.

I don’t know if there is something that might throw some light on it.

You could also check the Task Manager and see what Process matches the event id 806 (if any), you may need to wait for this to happen again as the process id might well change.

6

May I ask what you were doing just before this event happened? That would be key in understanding this event.

These links might help with some understanding.

http://technet2.microsoft.com/windowsserver/en/library/962f5863-15df-4271-9ae0-4b0412e297491033.mspx?mfr=true

http://www.ultimatewindowssecurity.com/eventcat_policychange.html

And from this link … http://www.eventid.net/display.asp?eventid=806&source= … I found that 806 is a successful audit.

Success Audit - An audited security access attempt that succeeds. For example, a user's successful attempt to log on to the system will be logged as a Success Audit event.
I think this may be the answer to the question.
7

Hello,
It happenes at boot up so im not doing anything…
Source: security
Category: policy change
Type: success A
per user audit policy was refreshed
Number of elements:0
policy ID: (0x0.0xE5A9)

???