Windows Defender: Event 3004 never fires

Hello,

In Vista, when I modify a file in the drivers folder I don't see a

related event in the Event Viewer.

I modify %windir%\system32\drivers\etc\hosts and append a comment to

it. I've tested this on non-domain machines and it works, listing a

3004 Event ID, but it's not working on domain members. Does anyone

know why this might be?

Defender is running, and everything in real-time protection is checked

(except for "Software that has not yet been classified for risks" and

"Changes made to your computer by software that is permitted to run").

There are no path location exceptions.

Thank you~