WinSecWiki > Security Settings > Advanced Audit Policies > Object Access > Handle Manipulation
Audit Handle Manipulation
This category logs one and only one event. To configure this on Server 2008 and Vista you must use auditpol. Windows 7 and Server 2008 R2 and later can use Group Policy.
In Server 2012, to log removable storage device failure events, handle manipulation must also be enabled.
Coverage on events generated by this category are currently in the Security Log Encyclopedia:
Back to top