Object Deleted:
Object Server:Security
Handle ID:1468
Process ID:1688
Windows Server 2003 adds this field:
Image File Name:C:\WINDOWS\system32\notepad.exe
When an object for which successful delete access has been
enabled for auditing, Event 564 is logged upon actual deletion.
To determine the name of the object deleted look for a prior event 560 with the same handle ID. Normally event 560 and event 564 will
be in close proximity but it is theoretically possible for a
process to open an object (560) for delete access and then actually
delete it much later. See event 560 for further information.
