| Event Id | 4656 |
| Source | Microsoft-Windows-Security-Auditing |
| Description | A handle to an object was requested. Subject: Security ID:<Security ID> Account Name:<Account Name> Account Domain:<Account Domain> Logon ID:<Logon ID> Object: Object Server:<Object Server> Object Type:<Object Type> Object Name:<Object Name> Handle ID: <Handle ID> Process Information: Process ID: <Process ID> Process Name:<Process Name> Access Request Information: Transaction ID:<Transaction ID> Accesses:<Accesses> Access Mask:<Access Mask> Privileges Used for Access Check: Restricted SID Count:<Restricted SID Count> |
| Event Information | Cause : This event is genererated when any file or folder and registry of a system is accessed by Users. Note: This event is recorded when an user enable auditing on an object. Resolution : This is an information event and no user action is required. |
| Reference Links |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.