Home
Resources
Training
About Us
eStore

>

resources > security log resource center > encyclopedia > event 594

 

 

 

 

 

 

 

Latest Blog: Log monitoring and the Terry Childs/City of San Francisco debacle

 

Windows Security Log Events by ID

look up more events by Event ID or Category

Event ID

594

Title

A handle to an object has been duplicated

Type: Example: Randy's Comments:
Success

OS:

All versions

Category:

Detailed Tracking

A handle to an object has been duplicated
Source Handle ID: %1 Source Process ID: %2
Target Handle ID: %3 Target Process ID: %4

This simply means that the program obtained another handle to an object (e.g. file) that it already had open under a different handle. This handle may be passed on to a child process but in any case it will have the same level of access as the handle the file was originally opened under. To determine what file is involved, find the accompanying event 560 for with a handle ID that matches this event's source handle ID.

Microsoft's comments:

Expected activity.

Next:

Get all the tools you need in one newsletter!
Free log parser scripts, clear explanations of Microsoft's latest security bulletins, and more. View a sample issue.
Email Address:
Your email address will not be shared. You may unsubscribe at any time.


Upcoming Webinars by Randy Franklin Smith


Additional Links

A
D
V