Windows Event ID 4890 – Microsoft-Windows-Security-Auditing: A handle to an object was requested

Start by examining the event details to understand the context and scope of the object access request.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4890 by right-clicking the Security log and selecting Filter Current Log
4. In the filter dialog, enter 4890 in the Event IDs field
5. Double-click on a 4890 event to view detailed information including:
   • Subject: User account making the request
   • Object: Target object path and type
   • Process Information: Executable name and process ID
   • Access Request Information: Requested access rights
6. Note the Object Name field to identify which resource was accessed
7. Check the Access Mask value to understand requested permissions

Use PowerShell to efficiently query and analyze Event ID 4890 occurrences across time ranges and specific criteria.

1. Open PowerShell as Administrator
2. Query recent 4890 events:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4890} -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message

3. Filter events by specific object types:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4890; StartTime=(Get-Date).AddHours(-24)} | Where-Object {$_.Message -like "*\Windows\System32\*"}

4. Extract key information from events:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4890} -MaxEvents 100 | ForEach-Object {
       $xml = [xml]$_.ToXml()
       [PSCustomObject]@{
           TimeCreated = $_.TimeCreated
           SubjectUserName = $xml.Event.EventData.Data[1].'#text'
           ObjectName = $xml.Event.EventData.Data[6].'#text'
           ProcessName = $xml.Event.EventData.Data[9].'#text'
           AccessMask = $xml.Event.EventData.Data[10].'#text'
       }
   }

5. Export results for further analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4890; StartTime=(Get-Date).AddDays(-7)} | Export-Csv -Path "C:\Temp\Event4890_Analysis.csv" -NoTypeInformation

Properly configure auditing policies to control when Event ID 4890 is generated and ensure you're capturing the right level of detail.

1. Open Group Policy Management Console or Local Group Policy Editor (gpedit.msc)
2. Navigate to Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Object Access
3. Configure the following policies based on your monitoring needs:
   • Audit File System: Enable for file and folder access
   • Audit Registry: Enable for registry key access
   • Audit Handle Manipulation: Enable for handle operations
   • Audit Kernel Object: Enable for system object access
4. Set each policy to Success and Failure for comprehensive monitoring
5. Apply the policy using:

   gpupdate /force

6. Verify policy application:

   auditpol /get /category:"Object Access"

7. For specific file/folder auditing, configure SACL (System Access Control List):

   icacls "C:\Sensitive\" /grant "Everyone:(OI)(CI)F" /audit "Everyone:(OI)(CI)F"

Perform advanced analysis to identify suspicious patterns, correlate with other security events, and build comprehensive audit trails.

1. Create a PowerShell script to analyze access patterns:

   # Analyze 4890 events for unusual patterns
   $events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4890; StartTime=(Get-Date).AddDays(-1)}
   
   $analysis = $events | ForEach-Object {
       $xml = [xml]$_.ToXml()
       [PSCustomObject]@{
           Time = $_.TimeCreated
           User = $xml.Event.EventData.Data[1].'#text'
           Object = $xml.Event.EventData.Data[6].'#text'
           Process = $xml.Event.EventData.Data[9].'#text'
           AccessMask = $xml.Event.EventData.Data[10].'#text'
       }
   }
   
   # Group by user to identify high-volume access
   $analysis | Group-Object User | Sort-Object Count -Descending | Select-Object Name, Count

2. Correlate with logon events (4624) to track user sessions:

   $logons = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=(Get-Date).AddHours(-2)}
   $objectAccess = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4890; StartTime=(Get-Date).AddHours(-2)}
   
   # Cross-reference logon times with object access

3. Identify access to sensitive locations:

   $sensitiveObjects = @("*\Windows\System32\config\*", "*\Users\*\Documents\*", "*\Program Files\*")
   $events | Where-Object {$_.Message -match ($sensitiveObjects -join "|")}

4. Set up automated monitoring with scheduled tasks:

   $action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\Monitor4890.ps1"
   $trigger = New-ScheduledTaskTrigger -Daily -At "09:00"
   Register-ScheduledTask -TaskName "Monitor4890Events" -Action $action -Trigger $trigger

5. Export findings to SIEM or log analysis platform for long-term trending

Deploy enterprise-grade monitoring solutions to handle high-volume 4890 events and implement intelligent alerting for security incidents.

1. Configure Windows Event Forwarding (WEF) for centralized collection:

   # On collector server
   wecutil cs subscription.xml
   
   # subscription.xml content:
   <Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
       <SubscriptionId>Security4890Collection</SubscriptionId>
       <Query><![CDATA[
           <QueryList>
               <Query Id="0">
                   <Select Path="Security">*[System[EventID=4890]]</Select>
               </Query>
           </QueryList>
       ]]></Query>
   </Subscription>

2. Set up custom Windows Performance Toolkit (WPT) traces for detailed analysis:

   wpr -start GeneralProfile -start CPU -start FileIO

3. Configure Microsoft Sentinel (if available) with custom KQL queries:

   SecurityEvent
   | where EventID == 4890
   | where TimeGenerated > ago(1h)
   | summarize count() by Account, ObjectName
   | where count_ > 100

4. Implement PowerShell-based real-time monitoring:

   # Real-time event monitoring
   Register-WmiEvent -Query "SELECT * FROM Win32_NTLogEvent WHERE LogFile='Security' AND EventCode=4890" -Action {
       $event = $Event.SourceEventArgs.NewEvent
       if ($event.Message -match "sensitive_pattern") {
           Send-MailMessage -To "security@company.com" -Subject "Suspicious 4890 Event" -Body $event.Message
       }
   }

5. Create custom Event Log views for rapid triage:
   • Open Event Viewer → Custom Views → Create Custom View
   • Filter by Event ID 4890 and specific criteria
   • Save as "Critical Object Access" for quick access
6. Integrate with third-party SIEM solutions using standard syslog forwarding or API connectors