567: Object Access Attempt

On this page

• Description of this event
• Field level details
• Examples
• Discuss this event
• Mini-seminars on this event

Event 567 logs the actual permissions exercised by the user/program on the object after opening it. While event 560 logs the permissions the user/program obtained to the file or other object at the time it was opened, Event 567 asserts that the Accesses where actually used.

For this event to be useful - that is to identify the object accessed - you must find the preceding event 560 with the corresponding Handle ID.

While a user/program may repeatedly perform an operation on an open object, Windows only logs the first time a given permission is used. (I.E. a user may open a file and repeatedly save it while working on the file, but Windows will only log the first time WriteData permission was exercised to save the file)

See event ID 560 for additional information.

Description Fields in 567 Object Server: Handle ID: Object Type: Process ID: Image File Name: Accesses: Access Mask: Top 10 Windows Security Events to Monitor Examples of 567 Object Access Attempt: Object Server:Security Handle ID:144 Object Type:File Process ID:3156 Image File Name:C:\WINDOWS\system32\notepad.exe Accesses:WriteData (or AddFile) AppendData (or AddSubdirectory or CreatePipeInstance) Access Mask:0x6 Keep me up-to-date on the Windows Security Log. Email*: *We will NOT share this

Training for the Windows Security Log

Mini-Seminars Covering Event ID 567 Monitoring Active Directory for Security and Compliance: How Far Does the Native Audit Log Take You? Security Log Exposed: 8 Ways to Spot Misuse, Malware and Malefactors with Windows File System Auditing

Discussions on Event ID 567 • Tracking Rename using Event ID 567

 

Upcoming Webinars 3 Ways Two-Factor Authentication Can Stop APTs from Spreading Understanding the Security Boundaries and Risks of Multiple Domains, Forests and Trust Relationships 6 Steps to Classifying Your Data Top 6 Security Events to Monitor in SQL Server Top 10 Security Events to Monitor in SharePoint

Additional Resources Security Log Quick Reference Chart Learn about the SharePoint Audit Log Patch Tuesday Analysis

•	All Event IDs
•	Audit Policy