Windows event ID 4817 - Auditing settings on an object were changed

Event ID: 

4817

Category: 

Policy Change

Subcategory: 

Audit Policy Change

Supported on: 

Windows 7, Windows Server 2008 R2

A handle to an object was requested.

Subject:
Security ID: %1
Account Name: %2
Account Domain: %3
Logon ID: %4

Object:
Object Server:%5
Object Type:%6
Object Name: %7
Handle ID: %8

Process Information:
Process ID: %15
Process Name: %16

Access Request Information:
Transaction ID: %9
Accesses: %10
Access Reasons: %11
Access Mask: %12
Privileges Used for Access Check: %13
Restricted SID Count: %14