Monitor and Server Health Group

Monitor pack for monitor Solution 6 (conversion to monitor Solution 7 in progress)

Windows uses this category to log events that affect the security of the entire system. Good idea to log both success and failure events!

• 512 Windows NT is starting up.
• 513 Windows NT is shutting down.
• 514 An authentication package has been loaded by the Local Security Authority.
• 515 A trusted logon process has registered with the Local Security Authority.
• 516 Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits.
• 517 The audit log was cleared.
• 518 A notification package has been loaded by the Security Account Manager.