Skip to content

Object-Access

Windows Event ID 4656: A handle to an object was requested

July 3, 2026

Windows Event ID 4657: A registry value was modified

July 3, 2026

Windows Event ID 4658: The handle to an object was closed

July 3, 2026

Windows Event ID 4660: An object was deleted

July 3, 2026

Windows Event ID 4661: A handle to an AD/SAM object was requested

July 3, 2026

Windows Event ID 4662: An operation was performed on an object

July 3, 2026

Windows Event ID 4663: An attempt was made to access an object

July 3, 2026

Windows Event ID 4664: An attempt was made to create a hard link

July 3, 2026

Windows Event ID 4670: Permissions on an object were changed

July 3, 2026

Windows Event ID 4671: An application attempted to access a blocked ordinal through the TBS

July 3, 2026

Windows Event ID 4690: An attempt was made to duplicate a handle to an object

July 3, 2026

Windows Event ID 4691: Indirect access to an object was requested

July 3, 2026

Windows Event ID 4818: Proposed Central Access Policy does not grant the same access as the current one

July 3, 2026

Windows Event ID 4985: The state of a transaction has changed

July 3, 2026

Windows Event ID 5039: A registry key was virtualized

July 3, 2026

Windows Event ID 5051: A file was virtualized

July 3, 2026

Windows Event ID 5140: A network share object was accessed

July 3, 2026

Windows Event ID 5142: A network share object was added

July 3, 2026

Windows Event ID 5143: A network share object was modified

July 3, 2026

Windows Event ID 5144: A network share object was deleted

July 3, 2026

Windows Event ID 5145: A network share object was checked for desired access (detailed file share)

July 3, 2026

Windows Event ID 5148: WFP detected a DoS attack and entered a defensive mode

July 3, 2026

Windows Event ID 5149: The DoS attack has subsided and normal processing is being resumed

July 3, 2026

Windows Event ID 5168: SPN check for SMB/SMB2 failed

July 3, 2026

Windows Event ID 5712: A Remote Procedure Call (RPC) was attempted

July 3, 2026

Windows Event ID 5888: An object in the COM+ Catalog was modified

July 3, 2026

Windows Event ID 5889: An object was deleted from the COM+ Catalog

July 3, 2026

Windows Event ID 5890: An object was added to the COM+ Catalog

July 3, 2026

Windows Event ID 6416: A new external device was recognized by the System

July 3, 2026

Windows Event ID 6419: A request was made to disable a device

July 3, 2026

Windows Event ID 6420: A device was disabled

July 3, 2026

Windows Event ID 6421: A request was made to enable a device

July 3, 2026

Windows Event ID 6422: A device was enabled

July 3, 2026

Windows Event ID 6423: The installation of this device is forbidden by system policy

July 3, 2026

Windows Event ID 6424: The installation of this device was allowed, after previously being forbidden by policy

July 3, 2026