Event-o-Pedia EventID 596 - Backup of data protection master key

	Event Details
	Operating System->Microsoft Windows->Built-in logs->Windows 2000-2003->Security Log->Detailed Tracking->EventID 596 - Backup of data protection master key

EventID 596 - Backup of data protection master key

The operating system performed a normal backup of the Data Protection application programming interface (DPAPI) master key.

Note:
If this computer is a member of a Windows NT 4.0 domain, this message might contain failure information because Windows NT 4.0 domains do not support DPAPI keys storage.

Find more information about this event on ultimatewindowssecurity.com.

Corresponding events on other OS versions:

Windows 2008

EventID 4692 - Backup of data protection master key was attempted

Sample:

        Event Type:	Success Audit
        Event Source:	Security
        Event Category:	Detailed Tracking
        Event ID:	596
        Date:		1/30/2009
        Time:		6:40:24 PM
        User:		RESEARCH\Administrator
        Computer:	DC1
        Description:
        Backup of data protection master key.
        Key Identifier:		c15ca47b-b87e-4645-ab1d-ba10f0a195f1
        Recovery Server:		\\DC1.RESEARCH.CORP
        Recovery Key ID:		bb6017d0-3102-4f23-a983-886684d242bd
        Failure Reason:		0x0

Log Type:

Windows Event Log

Uniquely Identified By:

Log Name:

Security

Filtering Field	Equals to Value
OSVersion	Windows 2000 Windows XP Windows 2003
Category	Detailed Tracking
Source	Security
EventId	596

Field Matching

Field	Description	Stored in	Sample Value
DateTime	Date/Time of event origination in GMT format.	DateTime	10.10.2000 19:00:00
Source	Name of an Application or System Service originating the event.	Source	Security
Type	Warning, Information, Error, Success, Failure, etc.	Type	Success
User	Domain\Account name of user/service/computer initiating event.	User	RESEARCH\Alebovsky
Computer	Name of server workstation where event was logged.	Computer	DC1
EventID	Numerical ID of event. Unique within one Event Source.	EventId	576
Description	The entire unparsed event message.	Description	Special privileges assigned to new logon.
Log Name	The name of the event log (e.g. Application, Security, System, etc.)	LogName	Security
Category	A name for a subclass of events within the same Event Source.	Category	Logon/Logoff
Key Identifier	GUID of the master key	InsertionString1	c15ca47b-b87e-4645-ab1d-ba10f0a195f1
Recovery Server	The name of the server where the key is stored	InsertionString2	\\DC1.RESEARCH.CORP
Recovery Key ID	ID of the recovery key	InsertionString3	bb6017d0-3102-4f23-a983-886684d242bd
Failure Reason	The code for the reason of failure in case of the failed backup	InsertionString4	0x0