Windows Event ID 4907 – Microsoft-Windows-Security-Auditing: A handle to an object was requested

Start by examining the specific details of Event ID 4907 to understand the access request context.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4907 by right-clicking the Security log and selecting Filter Current Log
4. In the filter dialog, enter 4907 in the Event IDs field and click OK
5. Double-click on a 4907 event to view detailed information including:
   • Subject: User account making the request
   • Object: Target object name and type
   • Process Information: Process ID and name
   • Access Request Information: Requested access rights
6. Note the Object Name field to identify which specific object was accessed
7. Check the Access Mask value to understand the type of access requested

Use PowerShell to efficiently query and analyze Event ID 4907 occurrences across time ranges.

1. Open PowerShell as Administrator
2. Query recent Event ID 4907 entries:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4907} -MaxEvents 50 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

3. Filter events by specific time range:

   $StartTime = (Get-Date).AddHours(-24)
   $EndTime = Get-Date
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4907; StartTime=$StartTime; EndTime=$EndTime}

4. Extract specific event properties for analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4907} -MaxEvents 100 | ForEach-Object {
       $Event = [xml]$_.ToXml()
       [PSCustomObject]@{
           TimeCreated = $_.TimeCreated
           ProcessName = $Event.Event.EventData.Data | Where-Object {$_.Name -eq 'ProcessName'} | Select-Object -ExpandProperty '#text'
           ObjectName = $Event.Event.EventData.Data | Where-Object {$_.Name -eq 'ObjectName'} | Select-Object -ExpandProperty '#text'
           SubjectUserName = $Event.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text'
       }
   }

5. Export results to CSV for further analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4907} -MaxEvents 1000 | Export-Csv -Path "C:\Temp\Event4907_Analysis.csv" -NoTypeInformation

Properly configure auditing policies to ensure Event ID 4907 captures relevant security events without overwhelming the system.

1. Open Local Group Policy Editor by running gpedit.msc
2. Navigate to Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Audit Policies → Object Access
3. Configure the following policies:
   • Audit File System: Set to Success and Failure for comprehensive monitoring
   • Audit Registry: Enable for registry access monitoring
   • Audit Handle Manipulation: Enable to track handle operations
4. Apply specific auditing to critical objects using auditpol.exe:

   auditpol /set /subcategory:"File System" /success:enable /failure:enable
   auditpol /set /subcategory:"Registry" /success:enable /failure:enable
   auditpol /set /subcategory:"Handle Manipulation" /success:enable /failure:enable

5. Configure SACL (System Access Control List) on specific files or folders:

   $Path = "C:\Sensitive\Data"
   $AccessRule = New-Object System.Security.AccessControl.FileSystemAuditRule("Everyone", "FullControl", "ContainerInherit,ObjectInherit", "None", "Success,Failure")
   $ACL = Get-Acl $Path
   $ACL.SetAuditRule($AccessRule)
   Set-Acl -Path $Path -AclObject $ACL

6. Verify current audit policy settings:

   auditpol /get /category:"Object Access"

Perform advanced analysis to identify suspicious access patterns and correlate Event ID 4907 with other security events.

1. Create a PowerShell script to analyze access patterns:

   # Analyze Event 4907 patterns
   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4907} -MaxEvents 5000
   $Analysis = $Events | ForEach-Object {
       $Event = [xml]$_.ToXml()
       $EventData = $Event.Event.EventData.Data
       [PSCustomObject]@{
           Time = $_.TimeCreated
           User = ($EventData | Where-Object {$_.Name -eq 'SubjectUserName'}).'#text'
           Process = ($EventData | Where-Object {$_.Name -eq 'ProcessName'}).'#text'
           Object = ($EventData | Where-Object {$_.Name -eq 'ObjectName'}).'#text'
           AccessMask = ($EventData | Where-Object {$_.Name -eq 'AccessMask'}).'#text'
       }
   }
   
   # Group by user and process to identify patterns
   $UserPatterns = $Analysis | Group-Object User | Sort-Object Count -Descending
   $ProcessPatterns = $Analysis | Group-Object Process | Sort-Object Count -Descending
   
   Write-Host "Top Users by Access Requests:"
   $UserPatterns | Select-Object Name, Count | Format-Table
   
   Write-Host "Top Processes by Access Requests:"
   $ProcessPatterns | Select-Object Name, Count | Format-Table

2. Correlate with failed logon events (Event ID 4625):

   # Find potential correlation between failed logons and object access
   $FailedLogons = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 1000
   $ObjectAccess = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4907} -MaxEvents 1000
   
   # Analyze time correlation (within 5 minutes)
   $Correlations = foreach ($Logon in $FailedLogons) {
       $LogonTime = $Logon.TimeCreated
       $RelatedAccess = $ObjectAccess | Where-Object {
           $_.TimeCreated -gt $LogonTime.AddMinutes(-5) -and
           $_.TimeCreated -lt $LogonTime.AddMinutes(5)
       }
       if ($RelatedAccess) {
           [PSCustomObject]@{
               FailedLogonTime = $LogonTime
               RelatedAccessCount = $RelatedAccess.Count
               AccessEvents = $RelatedAccess
           }
       }
   }

3. Set up automated monitoring with Windows Task Scheduler:

   # Create monitoring script
   $ScriptPath = "C:\Scripts\Monitor4907.ps1"
   $ScriptContent = @'
   $RecentEvents = Get-WinEvent -FilterHashtable @{LogName="Security"; Id=4907; StartTime=(Get-Date).AddMinutes(-15)}
   if ($RecentEvents.Count -gt 100) {
       Write-EventLog -LogName Application -Source "Security Monitor" -EventId 1001 -EntryType Warning -Message "High volume of Event ID 4907 detected: $($RecentEvents.Count) events in last 15 minutes"
   }
   '@
   $ScriptContent | Out-File -FilePath $ScriptPath -Encoding UTF8
   
   # Register scheduled task
   Register-ScheduledTask -TaskName "Monitor Event 4907" -Trigger (New-ScheduledTaskTrigger -RepetitionInterval (New-TimeSpan -Minutes 15) -Once -At (Get-Date)) -Action (New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File $ScriptPath")

Configure advanced filtering and integrate Event ID 4907 with Security Information and Event Management (SIEM) systems for enterprise monitoring.

1. Create custom XML filters for Event Viewer:

   <QueryList>
     <Query Id="0" Path="Security">
       <Select Path="Security">
         *[System[EventID=4907]] and
         *[EventData[Data[@Name='ObjectName'] and (contains(., 'C:\Sensitive') or contains(., 'HKLM\SOFTWARE\Company'))]]
       </Select>
     </Query>
   </QueryList>

2. Configure Windows Event Forwarding (WEF) for centralized collection:

   wecutil cs C:\Config\4907-Subscription.xml

   Where the subscription XML includes:

   <Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
       <SubscriptionId>Event4907Collection</SubscriptionId>
       <Description>Collect Event ID 4907 from domain computers</Description>
       <Query><![CDATA[
           <QueryList>
               <Query Id="0">
                   <Select Path="Security">Event[System[EventID=4907]]</Select>
               </Query>
           </QueryList>
       ]]></Query>
   </Subscription>

3. Export events for SIEM ingestion using PowerShell:

   # Export to JSON for SIEM consumption
   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4907} -MaxEvents 1000
   $JsonOutput = $Events | ForEach-Object {
       $Event = [xml]$_.ToXml()
       $EventData = @{}
       $Event.Event.EventData.Data | ForEach-Object {
           $EventData[$_.Name] = $_.'#text'
       }
       [PSCustomObject]@{
           Timestamp = $_.TimeCreated.ToString('yyyy-MM-ddTHH:mm:ss.fffZ')
           EventId = $_.Id
           Level = $_.LevelDisplayName
           Computer = $_.MachineName
           EventData = $EventData
       }
   } | ConvertTo-Json -Depth 3
   
   $JsonOutput | Out-File -FilePath "C:\Logs\Event4907_$(Get-Date -Format 'yyyyMMdd_HHmmss').json" -Encoding UTF8

4. Configure log rotation and retention policies:

   # Set Security log size and retention
   $LogName = "Security"
   $MaxSize = 1GB
   $Retention = "OverwriteOlder"
   $RetentionDays = 90
   
   Limit-EventLog -LogName $LogName -MaximumSize $MaxSize -OverflowAction $Retention -RetentionDays $RetentionDays

5. Create alerting rules for suspicious patterns:

   # Alert on unusual access patterns
   $Threshold = 50
   $TimeWindow = 10 # minutes
   $RecentEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4907; StartTime=(Get-Date).AddMinutes(-$TimeWindow)}
   
   if ($RecentEvents.Count -gt $Threshold) {
       $AlertMessage = "SECURITY ALERT: Unusual object access activity detected. $($RecentEvents.Count) Event ID 4907 occurrences in the last $TimeWindow minutes."
       Write-EventLog -LogName Application -Source "Security Monitor" -EventId 2001 -EntryType Warning -Message $AlertMessage
       
       # Send email notification (configure SMTP settings)
       Send-MailMessage -To "security@company.com" -From "monitoring@company.com" -Subject "Security Alert: High Object Access Volume" -Body $AlertMessage -SmtpServer "smtp.company.com"
   }