4663:
An attempt was made to access an object
On this page
This event is logged by multiple subcategories as indicated above.
This event documents actual operations performed against files and other objects. This event is logged between the open (4656) and close (4658) events for the object being opened and can be correlated to those events via Handle ID.
While event 4656 tells you when the object is initially opened and what type of access was requested at that time; 4656 doesn't give you positive confirmation any of the access permissions were actually exercised. That is the role of this event. This event, 4663, is logged the first time one or more of the requested permissions are actually exercised. If the program repeatedly exercises a permission while the object is open, Windows only logs 4663 the first time.
Note events 4656 and 4658 will not appear unless the subcategory "Handle Manipulation" is enabled along with the target sub-category. Microsoft explains that this was done to make it more difficult to enable these noisy events. They feel the event 4663 is better.
Subject:
The user and logon session that performed the action.
- Security ID: The SID of the account.
- Account Name: The account logon name.
- Account Domain: The domain or - in the case of local accounts - computer name.
- Logon ID is a semi-unique (unique between reboots) number that identifies the logon session. Logon ID allows you to correlate backwards to the logon event (4624) as well as with other events logged during the same logon session.
Object:
This is the object upon whom the action was attempted.
- Object Server: always "Security"
- Object Type: "File" for file or folder but can be other types of objects such as Key, SAM, SERVICE OBJECT, etc.
- Object Name: The name of the object being accessed
- Handle ID: is a semi-unique (unique between reboots) number that identifies all subsequent audited events while the object is open. Handle ID allows you to correlate to other events logged (Open 4656, Access 4663, Close 4658)
Process Information:
Process ID is the process ID specified when the executable started as logged in 4688. The Process Name identifies the program executable that accessed the object.
Access Request Information:
- Accesses: These are permissions were actually exercised. The correspond to the permissions available in the Permission Entry dialog for any access control entry on the object. Access Mask: this is the bitwise equivalent of Accesses:
Top 10 Windows Security Events to Monitor
File example
An attempt was made to access an object.
Subject:
Security ID: ACME\Administrator
Account Name: Administrator
Account Domain: ACME
Logon ID: 0x1f41e
Object:
Object Server: Security
Object Type: File
Object Name: C:\sharedFiles\MasterEncryptionCode.txt
Handle ID: 0x40
Process Information:
Process ID: 0x1ac
Process Name: C:\Windows\System32\cmd.exe
Access Request Information:
Accesses: DELETE
Access Mask: 0x10000
Registry key example
An attempt was made to access an object.
Subject:
Security ID: ACME\administrator
Account Name: administrator
Account Domain: ACME
Logon ID: 0x176293
Object:
Object Server: Security
Object Type: Key
Object Name: \REGISTRY\MACHINE\SOFTWARE\MTG
Handle ID: 0x124
Process Information:
Process ID: 0x8d4
Process Name: C:\Windows\regedit.exe
Access Request Information:
Accesses: Set key value
Access Mask: 0x2
Keep me up-to-date on the Windows Security Log.
Email*:
*We will NOT share this
|
|