WinSecWiki > Security Settings > Advanced Audit Policies > Object Access > Kernal Object

Audit Kernel Object

This sub-category is probably only of interest to developers. An example of a kernel object is a security token. To configure this on Server 2008 and Vista you must use auditpol. Windows 7 and Server 2008 R2 and later can use Group Policy.

Event ID	Title
4656	A handle to an object was requested
4658	The handle to an object was closed

Back to top

 

Upcoming Webinars Patch Faster, Break Less: A Practical Guide to Windows 11 OS and 3rd Party Application Updates AI Security Hands-On: Understanding and Red Teaming the LLM as a Black Box Rethinking Privileged Access for the Age of AI-Powered Attacks Inside Entra ID Authentication: How Tokens, MFA, and Conditional Access Work and Where Attackers Break the Chain Understanding Entra Privileged Identity Management, What PIM Covers and Where It Stops

Additional Resources