Windows event ID 4656 - A handle to an object was requested

Event ID: 

4656

Category: 

Object Access

Subcategory: 

Handle Manipulation

Supported on: 

Windows Vista, Windows Server 2008

A handle to an object was requested.

Subject:
Security ID: %1
Account Name: %2
Account Domain: %3
Logon ID: %4

Object:
Object Server: %5
Object Type: %6
Object Name: %7
Handle ID: %8

Process Information:
Process ID: %14
Process Name: %15

Access Request Information:
Transaction ID: %9
Accesses: %10
Access Mask: %11
Privileges Used for Access Check: %12
Restricted SID Count: %13

Note: Events in this subcategory generate events only for object types where the corresponding Object Access subcategory is enabled. For example, if File system object access is enabled, handle manipulation security audit events are generated. If Registry object access is not enabled, handle manipulation security audit events will not be generated.

Related content