| Event Id | 597 |
| Source | Security |
| Description | Recovery of data protection master key. Key Identifier: < Key Identifier> Recovery Reason: < Recovery Reason> Recovery Server: < Recovery Server> Recovery Key ID: < Recovery Key ID> Failure Reason: < Failure Reason> |
| Event Information | According to Microsoft : Cause : A key that is used by the Data Protection application programming interface (DPAPI) is being recovered. Because the DPAPI keys are backed up on Active Directory, the computer can automatically recover a key when necessary. This message is logged for informational purposes only. It usually follows a Security 596 message, which indicates that the DPAPI key was backed up. There may be a period of days or weeks between the messages. Resolution : No user action is required. |
| Reference Links | Event ID 597 from Source Security Alternate Event ID in Vista and Windows Server 2008 is 4693. |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.