Event Details
User Activity->Policy Changes->Windows 2000-2003->EventID 643 - Domain Policy Changed [Win 2000]
EventID 643 - Domain Policy Changed [Win 2000]
 Sample: 
Event Type:	Success Audit
Event Source:	Security
Event Category:	Account Management 
Event ID:	643
Date:		5/4/2009
Time:		3:46:07 PM
User:		NT AUTHORITY\SYSTEM
Computer:	DC-AD
Description:
Domain Policy Changed: Password Policy modified
 	Domain Name:		ANNADOMAIN
 	Domain ID:	ANNADOMAIN\
 	Caller User Name:	DC-AD$
 	Caller Domain:	ANNADOMAIN
 	Caller Logon ID:	(0x0,0x3E7)
 	Privileges:	-
 Changed Attributes:
 	Min. Password Age:	-
 	Max. Password Age:	-
 	Force Logoff:	-
 	Lockout Threshold:	-
 	Lockout Observation Window:	-
 	Lockout Duration:	-
 	Password Properties:	16
 	Min. Password Length:	-
 	Password History Length:	1
 	Machine Account Quota:	-
   	Mixed Domain Mode:	-
 	Domain Behavior Version:	-
 	OEM Information:	-


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Log Type: Windows Event Log
 Uniquely Identified By:
Log Name: Security
Filtering Field Equals to Value
OSVersion Windows 2000
Windows XP
Category Account Management
Source Security
EventId 643
Field Matching
FieldDescriptionStored inSample Value
When At what date and time a user activity originated in the system. DateTime 12/14/2009 6:59:09 AM
Who Account or user name under which the activity occured. Caller User Name Alebovsky
What The type of activity occurred (e.g. Logon, Password Changed, etc.) "Policy Change" Policy Change
Where The name of the workstation/server where the activity was logged. Computer DC1
Where From The name of the workstation/server where the activity was initiated from. - 10.10.10.10
Severity Specify the seriousness of the event. "High" High
WhoDomain Caller Domain RESEARCH
WhereDomain -
Policy Name The name of the affected policy. Domain Policy Changed
Comments
You must be logged in to comment