Event ID 4658
The handle to an object was closedThe handle to an object was closed.
Subject :
Security ID: %1
Account Name: %2
Account Domain: %3
Logon ID: %4
Object:
Object Server: %5
Handle ID: %6
Process Information:
Process ID: %7
Process Name: %8 Auditing:
It's not recommended to audit the "Kernel Object" subcategory.
Microsoft Documentation
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /category:"Object Access" Operating Systems:
Windows VistaWindows 2008Windows 7Windows 2008 R2Windows 8Windows 2012Windows 8.1Windows 2012 R2Windows 10Windows 2016Windows 2019Windows 2022Windows 2025Tags:
Audit SuccessAudit Category:
Object AccessAudit Subcategory:
File SystemHandle ManipulationKernel ObjectRegistryRemovable StorageLEFT/RIGHT arrow keys for navigation
Back to List