Event-o-Pedia EventID 615 - IPSEC PolicyAgent Service [Win 2000]

	Event Details
	Operating System->Microsoft Windows->Built-in logs->Windows 2000-2003->Security Log->Detailed Tracking->EventID 615 - IPSEC PolicyAgent Service [Win 2000]

EventID 615 - IPSEC PolicyAgent Service [Win 2000]

Indicates a change to the IPsec policy.

Note:
Should be investigated when they occur outside of a system startup.

Find more information about this event on ultimatewindowssecurity.com.

Corresponding events on other OS versions:

Windows 2003 / XP
Note: In Windows 2003 /XP this event moves to the category "Policy Change", and "IPSec Policy Agent" is renamed to "IPSec Services".

EventID 615 - IPSEC Service [Win 2003 / XP]

Sample:

        Event Type:     Success Audit
        Event Source:   Security
        Event Category: Detailed Tracking
        Event ID:       615
        Date:           10/26/2009
        Time:           07:41:25
        User:           BUILTIN\Administrators
        Computer:       DC1
        Description:
        IPSEC PolicyAgent Service: Service is shutting down.

Log Type:

Windows Event Log

Uniquely Identified By:

Log Name:

Security

Filtering Field	Equals to Value
OSVersion	Windows 2000
Category	Detailed Tracking
Source	Security
EventId	615

Field Matching

Field	Description	Stored in	Sample Value
DateTime	Date/Time of event origination in GMT format.	DateTime	10.10.2000 19:00:00
Source	Name of an Application or System Service originating the event.	Source	Security
Type	Warning, Information, Error, Success, Failure, etc.	Type	Success
User	Domain\Account name of user/service/computer initiating event.	User	RESEARCH\Alebovsky
Computer	Name of server workstation where event was logged.	Computer	DC1
EventID	Numerical ID of event. Unique within one Event Source.	EventId	576
Description	The entire unparsed event message.	Description	Special privileges assigned to new logon.
Log Name	The name of the event log (e.g. Application, Security, System, etc.)	LogName	Security
Category	A name for a subclass of events within the same Event Source.	Category	Logon/Logoff
IPSec Policy Agent Service	Displays event description from the IPSec Policy Agent Service	InsertionString1	IPSEC PolicyAgent Service: Service is shutting down.