Windows Security Log Event ID 4663
Operating Systems Windows Vista
Windows Server 2008
Category
 • Subcategory
Object Access
 • File System
 • Registry
 • SAM
 • Other Object Access Events
Type Success
Corresponding events
in Windows 2003
and before
567  
Discussions on Event ID 4663
Unknown Account name
windows 7 creates false positive 4663 access events

4663: An attempt was made to access an object

On this page

This event is logged by multiple subcategories as indicated above.

This event documents actual operations performed against files and other objects.  This event is logged between the open (4656) and close (4658) events for the object being opened and can be correlated to those events via Handle ID. 

While event 4656 tells you when the object is initially opened and what type of access was requested at that time; 4656 doesn't give you positive confirmation any of the access permissions were actually exercised.  That is the role of this event.  This event, 4663, is logged the first time one or more of the requested permissions are actually exercised.  If the program repeatedly exercises a permission while the object is open, Windows only logs 4663 the first time.

Note events 4656 and 4658 will not appear unless the subcategory "Handle Manipulation" is enabled along with the target sub-category. Microsoft explains that this was done to make it more difficult to enable these noisy events. They feel the event 4663 is better.

Subject:

The user and logon session that performed the action. 

  • Security ID:  The SID of the account.
  • Account Name: The account logon name.
  • Account Domain: The domain or - in the case of local accounts - computer name.
  • Logon ID is a semi-unique (unique between reboots) number that identifies the logon session.  Logon ID allows you to correlate backwards to the logon event (4624) as well as with other events logged during the same logon session.

Object:

This is the object upon whom the action was attempted.   

  • Object Server: always "Security"
  • Object Type: "File" for file or folder but can be other types of objects such as Key, SAM, SERVICE OBJECT, etc.
  • Object Name: The name of the object being accessed
  • Handle ID: is a semi-unique (unique between reboots) number that identifies all subsequent audited events while the object is open.  Handle ID allows you to correlate to other events logged (Open 4656, Access 4663, Close 4658

Process Information:

Process ID is the process ID specified when the executable started as logged in 4688. The Process Name identifies the program executable that accessed the object. 

Access Request Information:

  • Accesses: These are permissions were actually exercised.  The correspond to the permissions available in the Permission Entry dialog for any access control entry on the object. Access Mask: this is the bitwise equivalent of Accesses:

Top 10 Windows Security Events to Monitor

File example

An attempt was made to access an object.

Subject:
   Security ID:  ACME\Administrator
   Account Name:  Administrator
   Account Domain:  ACME
   Logon ID:  0x1f41e

Object:
   Object Server: Security
   Object Type: File
   Object Name: C:\sharedFiles\MasterEncryptionCode.txt
   Handle ID: 0x40

Process Information:
   Process ID: 0x1ac
   Process Name: C:\Windows\System32\cmd.exe

Access Request Information:
   Accesses: DELETE
   Access Mask: 0x10000


Registry key example

An attempt was made to access an object.

Subject:
   Security ID:  ACME\administrator
   Account Name:  administrator
   Account Domain:  ACME
   Logon ID:  0x176293

Object:
   Object Server: Security
   Object Type: Key
   Object Name: \REGISTRY\MACHINE\SOFTWARE\MTG
   Handle ID: 0x124

Process Information:
   Process ID: 0x8d4
   Process Name: C:\Windows\regedit.exe

Access Request Information:
   Accesses: Set key value
   Access Mask: 0x2

Keep me up-to-date on the Windows Security Log.
Email*:
*We will NOT share this



Training for the Windows Security Log