WinSecWiki > Security Settings > Local Policies > Audit Policy > Object Access > File System

File System

This category allows you to track access to files and folders. To enable or disable this category you must use the auditpol command.

Coverage on events generated by this category are currently in the Security Log Encyclopedia:

Event ID	Title
4656	A handle to an object was requested
4658	The handle to an object was closed
4660	An object was deleted
4663	An attempt was made to access an object
4685	The state of a transaction has changed
4985	The state of a transaction has changed.

Back to top

 

Upcoming Webinars Zero Standing Privilege: The Explosion of Machine Identity Requires a New Model Enforcing Identity at Runtime: Closing the Gaps AI-Powered Attacks Exploit First

Additional Resources