Event Details
Operating System->Microsoft Windows->Built-in logs->Windows 2000-2003->Security Log->Detailed Tracking->EventID 596 - Backup of data protection master key
EventID 596 - Backup of data protection master key
The operating system performed a normal backup of the Data Protection application programming interface (DPAPI) master key.

If this computer is a member of a Windows NT 4.0 domain, this message might contain failure information because Windows NT 4.0 domains do not support DPAPI keys storage.

Find more information about this event on ultimatewindowssecurity.com.

Corresponding events on other OS versions:

Windows 2008
        Event Type:	Success Audit
        Event Source:	Security
        Event Category:	Detailed Tracking
        Event ID:	596
        Date:		1/30/2009
        Time:		6:40:24 PM
        User:		RESEARCH\Administrator
        Computer:	DC1
        Backup of data protection master key.
        Key Identifier:		c15ca47b-b87e-4645-ab1d-ba10f0a195f1
        Recovery Server:		\\DC1.RESEARCH.CORP
        Recovery Key ID:		bb6017d0-3102-4f23-a983-886684d242bd
        Failure Reason:		0x0
Log Type: Windows Event Log
 Uniquely Identified By:
Log Name: Security
Filtering Field Equals to Value
OSVersion Windows 2000
Windows XP
Windows 2003
Category Detailed Tracking
Source Security
EventId 596
Field Matching
FieldDescriptionStored inSample Value
DateTime Date/Time of event origination in GMT format. DateTime 10.10.2000 19:00:00
Source Name of an Application or System Service originating the event. Source Security
Type Warning, Information, Error, Success, Failure, etc. Type Success
User Domain\Account name of user/service/computer initiating event. User RESEARCH\Alebovsky
Computer Name of server workstation where event was logged. Computer DC1
EventID Numerical ID of event. Unique within one Event Source. EventId 576
Description The entire unparsed event message. Description Special privileges assigned to new logon.
Log Name The name of the event log (e.g. Application, Security, System, etc.) LogName Security
Category A name for a subclass of events within the same Event Source. Category Logon/Logoff
Key Identifier GUID of the master key InsertionString1 c15ca47b-b87e-4645-ab1d-ba10f0a195f1
Recovery Server The name of the server where the key is stored InsertionString2 \\DC1.RESEARCH.CORP
Recovery Key ID ID of the recovery key InsertionString3 bb6017d0-3102-4f23-a983-886684d242bd
Failure Reason The code for the reason of failure in case of the failed backup InsertionString4 0x0
You must be logged in to comment