Policy Change Event: 623

Event ID 623 – Per User Audit Policy was refreshed

Event 623 is logged when the Per-User Audit Policy is set for a user. The Per-User Audit Policy is a way of fine-tuning the audit policy based on the environment's particular needs, so that only the success and failure events of important audit categories and objects are logged. Per-user auditing provides a method to include and exclude event categories based on a per-security-principle.

Event IDs 806 and 807 are related to this event.

Why does event ID 623 need to be monitored?

• To ensure security events are not disabled for certain specific users
• To check if global auditing is enabled
• To monitor the activity of high-value accounts
• To check if there is a per-user audit feature outside of standard procedures

Pro Tip:

ADAudit Plus helps you avoid the GPOs monitoring complexities with real-time pre-configured reports and auditing of the changes along with alerts within a Domain & OU. The advanced Group Policy settings real-time audit reports highlight the elusive change details, and also provide the old and new values of the modified attributes.