Windows Security Log Event ID 4664

Operating Systems Windows 2008 R2 and 7
Windows 2012 R2 and 8.1
Windows 2016 and 10
Windows Server 2019 and 2022
 • Subcategory
Object Access
 • File System
Type Success
Corresponding events
in Windows 2003
and before

4664: An attempt was made to create a hard link

On this page

An attempt was made to create a hard link.

A hard link is a pointer to a file on the same system.

Free Security Log Resources by Randy

Description Fields in 4664


  • Account Name:
  • Account Name:
  • Account Domain:
  • Logon ID:

Link Information:

  • File Name:
  • Link Name:
  • Transaction ID:

Supercharger Enterprise


Examples of 4664

An attempt was made to create a hard link.

  Account Name:  SYSTEM
  Account Name:  LABMS$
  Account Domain:  LAB
  Logon ID:  0x3e7

Link Information:
  File Name: C:\Windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_6.0.6001.18183_none_12ef96002267a3d0\mshtml.tlb
  Link Name: C:\Windows\System32\mshtml.tlb
  Transaction ID: {4185d0f7-d5b9-11dd-a7c2-000c29b41689}

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection


Additional Resources