Windows Security Log Event ID 562

Operating Systems Windows Server 2000
Windows 2003 and XP
CategoryObject Access
Type Success
Corresponding events
in Windows 2008
and Vista

562: Handle Closed

On this page

After successfully opening an object, a program eventually closes it which is documented by this event. Event 562 helps you determine how long the object was open. For this event to be useful you must link it back to the earlier event ID 560 with the same handle ID.

See event ID 560 for explanation of Process ID and Image File Name.

Microsoft's comments:

Always records as a success.

Free Security Log Resources by Randy

Description Fields in 562

  • Object Server:
  • Handle ID:
  • Process ID:

The following field also appears in Windows Server 2003:

  • Image File Name: (Path and file of program that accessed the object)

Supercharger Free Edition

Centrally manage WEC subscriptions.



Examples of 562

Handle Closed:
Object Server:Security
Handle ID:1468
Process ID:1688
Windows Server 2003 adds this field:
Image File Name:C:\WINDOWS\system32\notepad.exe

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection


Additional Resources