WinSecWiki > Security Settings > Local Policies > Audit Policy > Object Access > File System

File System

This category allows you to track access to files and folders. To enable or disable this category you must use the auditpol command.

Coverage on events generated by this category are currently in the Security Log Encyclopedia:

Event ID	Title
4656	A handle to an object was requested
4658	The handle to an object was closed
4660	An object was deleted
4663	An attempt was made to access an object
4685	The state of a transaction has changed
4985	The state of a transaction has changed.

Back to top

 

Upcoming Webinars Identity-First Security for AI Agents: Defending a New Attack Surface Across Cloud and SaaS Forget Prompt Injection: Your First M365 Copilot Security Job Is Paying Off Years of Permission Debt

Additional Resources