Windows Security Log Event ID 594

Operating Systems Windows Server 2000
Windows 2003 and XP
CategoryProcess Tracking
Type Success
Corresponding events
in Windows 2008
and Vista

594: A handle to an object has been duplicated

On this page

This simply means that the program obtained another handle to an object (e.g. file) that it already had open under a different handle. This handle may be passed on to a child process but in any case it will have the same level of access as the handle the file was originally opened under. To determine what file is involved, find the accompanying event 560 for with a handle ID that matches this event's source handle ID.

Microsoft's comments:

Expected activity.

Free Security Log Resources by Randy

Description Fields in 594

  • Source Handle ID:
  • Source Process ID:
  • Target Handle ID:
  • Target Process ID:

Supercharger Free Edition

Supercharger's built-in Xpath filters leave the noise behind.



Examples of 594

A handle to an object has been duplicated:

Source Handle ID: 1064
Source Process ID: 796
Target Handle ID: 1072
Target Process ID: 796

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection


Additional Resources