Event ID: 4659

A handle to an object was requested with intent to delete

A handle to an object was requested with intent to delete.

    Security ID:        %1
    Account Name:       %2
    Account Domain:     %3
    Logon ID:           %4

    Object Server:      %5
    Object Type:        %6
    Object Name:        %7
    Handle ID:          %8

Process Information:
    Process ID:         %13

Access Request Information:
    Transaction ID:     %9
    Accesses:           %10
    Access Mask:        %11
    Privileges Used for Access Check:   %12

This event is often logged instead of a 4663 event when a file is deleted.

This event also appears to be logged when a file that is currently locked by a process (or Windows) is attempted to be deleted.

Name Field Insertion String OS Example
Security ID SubjectUserSid %1 Any THEDOMAIN\TheUser
Account Name SubjectUserName %2 Any TheUser
Account Domain SubjectDomainName %3 Any THEDOMAIN
Logon ID SubjectLogonId %4 Any 0x5f2ac745
Object Server ObjectServer %5 Any Security
Object Type ObjectType %6 Any File
Object Name ObjectName %7 Any C:\Shares\Marketing\~secretplan.xlsx
Handle ID HandleId %8 Any 0x0
Transaction ID TransactionIdf %9 Any {00000000-0000-0000-0000-000000000000}
Accesses AccessList %10 Any -
Access Mask AccessMask %11 Any 0x0
Privileges Used for Access Check PrivilegeList %12 Any -
ProcessID ProcessId %13 Any 0x4

Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"File System"

LEFT/RIGHT arrow keys for navigation

Back to List