Event ID 623 – Per User Audit Policy was refreshed
Event 623 is logged when the Per-User Audit Policy is set for a user. The Per-User Audit Policy is a way of fine-tuning the audit policy based on the environment's particular needs, so that only the success and failure events of important audit categories and objects are logged. Per-user auditing provides a method to include and exclude event categories based on a per-security-principle.
Event IDs 806 and 807 are related to this event.
Why does event ID 623 need to be monitored?
- To ensure security events are not disabled for certain specific users
- To check if global auditing is enabled
- To monitor the activity of high-value accounts
- To check if there is a per-user audit feature outside of standard procedures
ADAudit Plus helps you avoid the GPOs monitoring complexities with real-time pre-configured reports and auditing of the changes along with alerts within a Domain & OU. The advanced Group Policy settings real-time audit reports highlight the elusive change details, and also provide the old and new values of the modified attributes.
Event 623 applies to the following operating systems:
- Windows Server 2000
- Windows 2003 and XP
Corresponding event ID in Windows 2008 and Windows Vista is 4912.