An object was deleted
On this page
This event is logged by multiple subcategories as indicated above.
This event is logged when an object is deleted where that object's audit policy has auditing enabled for deletions for the user who just deleted it or a group to which the user belongs.
To find out the object's name and type you will need to correlate back to to the event 4656 that has the same Handle ID.
In addition to this event you will also get event 4663 when you delete the object; Accesses: will include DELETE. 4663 identifies the object's name without requiring correlation to 4656.