There was a change in the gpo server, and I wonder if it is to discover which was the change. Following the event. How can i find? - System - Provider [ Name] Microsoft-Windows-GroupPolicy [ Guid] {aea1b4fa-97d1-45f2-a64c-4d69fffd92c9} EventID 4016 Version 0 Level 4 Task 0 Opcode 1 Keywords 0x4000000000000000 - TimeCreated [ SystemTime] 2010-07-29T16:49:24.609Z EventRecordID 2412 - Correlation [ ActivityID] {5EF873EA-C879-42C9-8FD8-BE7F1B64B4D3} - Execution [ ProcessID] 996 [ ThreadID] 2124 Channel Microsoft-Windows-GroupPolicy/Operational Computer WIN-05E46PBBRL7.teste.bsbrasil - Security [ UserID] S-1-5-18 - EventData CSEExtensionId {B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A} CSEExtensionName EFS recovery IsExtensionAsyncProcessing false IsGPOListChanged true GPOListStatusString %%4102 DescriptionString Default Domain Policy ApplicableGPOList <GPO ID="{31B2F340-016D-11D2-945F-00C04FB984F9}"><Name>Default Domain Policy</Name></GPO>

DescriptionString Default Domain Policy You would need 3rd party software like Hyena or Quest to determine what setting was changed. You could probably backup GPOs with GPMC and then when you get another event compare the two policies to find the change(s). It would be advisable to limit the number of people who can make changes to GPOs or turn on auditing to determine who makes a change. http://blogs.msdn.com/b/ericfitz/archive/2005/08/04/447951.aspx http://technet.microsoft.com/en-us/library/cc731607(WS.10).aspx I hope this information is useful.