Articles about eventid11 | UserComp.com

Windows Event ID 11: Policy.vpolfile created process (lsass.exe)

This article explains the meaning and implications of Event ID 11 in the Windows Sysmon event log, which indicates the creation of a VPOL file by the lsass.exe process.