This subcategory reports changes in security state of the system, such as when the security subsystem starts and stops. Events for this subcategory include:
? 4608: Windows is starting up.
? 4609: Windows is shutting down.
? 4616: The system time was changed.
? 4621: Administrator recovered system from CrashOnAuditFail. Users who are not administrators will now be allowed to log on. Some auditable ...