Event Message:

Encrypted Data Recovery Policy Changed: Changed By: User Name: user name Domain Name: name Logon ID: parameter Changes made: ('--' means no changes, otherwise each change is shown as: <ParameterName>: <new value> (<old value>)) value

Source Event Log Event ID Event Type
Security Security 617 Success Audit

Explanation:

This event record indicates that a local group has been deleted.