Handle Closed:
Object Server:Security
Handle ID:1468
Process ID:1688
Windows Server 2003 adds this field:
Image File Name:C:\WINDOWS\system32\notepad.exe
After successfully opening an object, a program eventually
closes it which is documented by this event. Event 562 helps
you determine how long the object was open. For this event to
be useful you must link it back to the earlier event ID 560 with
the same handle ID.
See event ID 560 for explanation of Process ID and Image File
Name.
