Windows Server Security Event 4656

Windows Server Security Event 4656:

A handle to an object was requested.

Subject:
Security ID: %1
Account Name: %2
Account Domain: %3
Logon ID: %4

Object:
Object Server: %5
Object Type: %6
Object Name: %7
Handle ID: %8

Process Information:
Process ID: %14
Process Name: %15

Access Request Information:
Transaction ID: %9
Accesses: %10
Access Mask: %11
Privileges Used for Access Check: %12
Restricted SID Count: %13

Note: Events in this subcategory generate events only for object types where the corresponding Object Access subcategory is enabled. For example, if File system object access is enabled, handle manipulation security audit events are generated. If Registry object access is not enabled, handle manipulation security audit events will not be generated.

Leave a Reply

Your email address will not be published. Required fields are marked *