#object-access

Windows Event ID 5484 – Microsoft-Windows-Security-Auditing: A handle to an object was requested

Event ID 5484 records when a process requests a handle to an object in Windows. This security audit event tracks object access attempts for compliance and security monitoring purposes.

Windows Event ID 4963 – Microsoft-Windows-Security-Auditing: Object Access Auditing Disabled

Event ID 4963 indicates that object access auditing has been disabled on a Windows system. This security event fires when audit policies for file, folder, or registry access monitoring are turned off.

Windows Event ID 4932 – Microsoft-Windows-Security-Auditing: An attempt was made to access an object

Event ID 4932 logs when a process attempts to access a security-protected object. This audit event fires when object access auditing is enabled and helps track file, registry, or service access attempts.

Windows Event ID 4890 – Microsoft-Windows-Security-Auditing: A handle to an object was requested

Event ID 4890 logs when a process requests a handle to a system object. This security audit event tracks object access attempts for compliance and security monitoring purposes.

Windows Event ID 4866 – Security: Object Operation Attempted

Event ID 4866 indicates an attempt to perform an operation on a security object, typically related to file system or registry access control modifications in Windows environments.

Windows Event ID 4887 – Microsoft-Windows-Security-Auditing: A handle to an object was requested

Event ID 4887 logs when a process requests a handle to a system object for access. This security audit event tracks object access attempts and helps monitor file, registry, and kernel object interactions across Windows systems.

Windows Event ID 4693 – Microsoft-Windows-Security-Auditing: Attempt to Access Protected System Object

Event ID 4693 logs when a process attempts to access a protected system object, typically indicating security policy enforcement or potential unauthorized access attempts in Windows environments.

Windows Event ID 4907 – Microsoft-Windows-Security-Auditing: A handle to an object was requested

Event ID 4907 logs when a process requests a handle to a system object. This security audit event tracks object access attempts for compliance and security monitoring purposes.

Windows Event ID 4663 – Security: An Attempt Was Made to Access an Object

Event ID 4663 logs when a process attempts to access a file, folder, registry key, or other securable object. This security audit event tracks object access attempts for compliance and forensic analysis.

Windows Event ID 4662 – Security: Object Access Auditing

Event ID 4662 logs when an operation is performed on an object with configured auditing. This security event tracks access attempts to files, folders, registry keys, and Active Directory objects.

Windows Event ID 4658 – Microsoft-Windows-Security-Auditing: Handle to an Object was Closed

Event ID 4658 logs when a handle to a system object is closed, providing audit trail for object access tracking in Windows security monitoring.

Windows Event ID 4656 – Microsoft-Windows-Security-Auditing: A Handle to an Object was Requested

Event ID 4656 logs when a process requests a handle to an object like files, registry keys, or processes. Critical for security auditing and access monitoring in Windows environments.