Windows Event ID 4658 – Microsoft-Windows-Security-Auditing: Handle to an Object was Closed

Start by examining the event details to understand what object was accessed and by which process.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4658 by right-clicking the Security log and selecting Filter Current Log
4. In the filter dialog, enter 4658 in the Event IDs field and click OK
5. Double-click a 4658 event to view details. Key fields to examine:
   • Subject: Shows the user account that closed the handle
   • Object: Displays the object type and name
   • Process Information: Identifies the executable that closed the handle
   • Handle Information: Contains the unique handle ID
6. Cross-reference the Handle ID with corresponding 4656 events to see when the handle was originally opened

Use PowerShell to efficiently query and analyze 4658 events across multiple systems or time periods.

1. Open PowerShell as Administrator
2. Query recent 4658 events:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4658} -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message

3. Filter events by specific object types:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4658} | Where-Object {$_.Message -like '*Object Type:*File*'} | Select-Object TimeCreated, Message

4. Analyze events from a specific process:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4658} | Where-Object {$_.Message -like '*Process Name:*notepad.exe*'} | Format-Table TimeCreated, Id -AutoSize

5. Export events for further analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4658; StartTime=(Get-Date).AddHours(-24)} | Export-Csv -Path "C:\Temp\4658_Events.csv" -NoTypeInformation

6. Count events by object type:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4658} -MaxEvents 1000 | ForEach-Object {($_.Message -split '\n' | Where-Object {$_ -like 'Object Type:*'}).Split(':')[1].Trim()} | Group-Object | Sort-Object Count -Descending

Adjust auditing policies to control which object types generate 4658 events and reduce log noise.

1. Open Group Policy Management Console or Local Group Policy Editor (gpedit.msc)
2. Navigate to Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Object Access
3. Configure specific audit subcategories:
   • Audit File System: Controls file and folder handle auditing
   • Audit Registry: Controls registry key handle auditing
   • Audit Handle Manipulation: Controls general handle operations
4. Set each policy to Success to audit successful handle closures, or Success and Failure for comprehensive tracking
5. Apply the policy using:

   gpupdate /force

6. Verify current audit settings:

   auditpol /get /category:"Object Access"

7. For specific file/folder auditing, configure SACLs (System Access Control Lists) on target objects through Properties → Security → Advanced → Auditing

Create comprehensive audit trails by correlating 4658 events with related handle operations.

1. Identify the Handle ID from a 4658 event you want to investigate
2. Search for the corresponding 4656 (handle opened) event:

   $HandleId = "0x1a4c"  # Replace with actual Handle ID
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4656} | Where-Object {$_.Message -like "*Handle ID:*$HandleId*"} | Select-Object TimeCreated, Message

3. Look for any 4663 (object accessed) events with the same Handle ID:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4663} | Where-Object {$_.Message -like "*Handle ID:*$HandleId*"} | Select-Object TimeCreated, Message

4. Create a timeline of all handle-related events:

   $Events = @()
   $Events += Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4656} | Where-Object {$_.Message -like "*Handle ID:*$HandleId*"}
   $Events += Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4663} | Where-Object {$_.Message -like "*Handle ID:*$HandleId*"}
   $Events += Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4658} | Where-Object {$_.Message -like "*Handle ID:*$HandleId*"}
   $Events | Sort-Object TimeCreated | Format-Table TimeCreated, Id, LevelDisplayName -AutoSize

5. Export the complete handle lifecycle for analysis:

   $Events | Sort-Object TimeCreated | Export-Csv -Path "C:\Temp\Handle_$HandleId_Lifecycle.csv" -NoTypeInformation

Implement advanced monitoring solutions for proactive 4658 event analysis and alerting.

1. Set up Windows Event Forwarding (WEF) to centralize 4658 events from multiple systems:

   # On collector server
   wecutil qc /q
   wecutil cs subscription.xml

2. Create a custom event subscription XML file targeting 4658 events:

   <Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
     <SubscriptionId>Handle-Closed-Events</SubscriptionId>
     <Query>
       <![CDATA[
         <QueryList>
           <Query Id="0">
             <Select Path="Security">*[System[EventID=4658]]</Select>
           </Query>
         </QueryList>
       ]]>
     </Query>
   </Subscription>

3. Configure Windows Performance Toolkit (WPT) for advanced handle tracking:

   # Install WPT from Windows SDK
   wpr -start GeneralProfile -start HandleProfile

4. Set up automated analysis with Task Scheduler:

   # Create scheduled task for daily 4658 analysis
   $Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\Analyze4658Events.ps1"
   $Trigger = New-ScheduledTaskTrigger -Daily -At "02:00AM"
   Register-ScheduledTask -TaskName "Daily4658Analysis" -Action $Action -Trigger $Trigger

5. Implement log rotation and archival to manage 4658 event volume:

   # Configure Security log size and retention
   Limit-EventLog -LogName Security -MaximumSize 512MB -OverflowAction OverwriteAsNeeded