Windows Security Log Event ID 562

Operating Systems Windows Server 2000
Windows 2003 and XP
CategoryObject Access
Type Success
Corresponding events
in Windows 2008
and Vista
Discussions on Event ID 562
Ask a question about this event

562: Handle Closed

On this page

After successfully opening an object, a program eventually closes it which is documented by this event. Event 562 helps you determine how long the object was open. For this event to be useful you must link it back to the earlier event ID 560 with the same handle ID.

See event ID 560 for explanation of Process ID and Image File Name.

Microsoft's comments:

Always records as a success.

Free Security Log Resources by Randy

Description Fields in 562

  • Object Server:
  • Handle ID:
  • Process ID:

The following field also appears in Windows Server 2003:

  • Image File Name: (Path and file of program that accessed the object)

Supercharger Free Edition

Supercharger's built-in Xpath filters leave the noise behind.



Examples of 562

Handle Closed:
Object Server:Security
Handle ID:1468
Process ID:1688
Windows Server 2003 adds this field:
Image File Name:C:\WINDOWS\system32\notepad.exe

Keep me up-to-date on the Windows Security Log.
*We will NOT share this

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection


Additional Resources