Event ID 4658

The handle to an object was closed

The handle to an object was closed.

Subject :
    Security ID:        %1
    Account Name:       %2
    Account Domain:     %3
    Logon ID:           %4

Object:
    Object Server:      %5
    Handle ID:          %6

Process Information:
    Process ID:         %7
    Process Name:       %8


Auditing:    

It's not recommended to audit the "Kernel Object" subcategory.


Microsoft Documentation

Event ID - 4658



NameFieldInsertion StringOSExample
Security IDSubjectUserSid%1Any THEDOMAIN\UserAbc
Account NameSubjectUserName%2Any UserAbc
Account DomainSubjectDomainName%3Any THEDOMAIN
Logon IDSubjectLogonId%4Any 0x43543
Object ServerObjectServer%5Any Security
Handle IDHandleId%6Any 0x1808
Process IDProcessId%7Any 0xef82
Process NameProcessName%8Any C:\Windows\System32\explorer.exe


Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /category:"Object Access"



LEFT/RIGHT arrow keys for navigation

Back to List