Event ID 4661

A handle to an object was requested

A handle to an object was requested.

Subject :
    Security ID:        %1
    Account Name:       %2
    Account Domain:     %3
    Logon ID:           %4

Object:
    Object Server:      %5
    Object Type:        %6
    Object Name:        %7
    Handle ID:          %8

Process Information:
    Process ID:         %15
    Process Name:       %16

Access Request Information:
    Transaction ID:     %9
    Accesses:           %10
    Access Mask:        %11
    Privileges Used for Access Check:   %12
    Properties:         %13
    Restricted SID Count:   %14


Indicates that a handle was requested for either an Active Directory object or a Security Account Manager (SAM) object.

If access was declined then an Audit Failure event is generated.

This event generates only if Success auditing is enabled for the Audit Handle Manipulation subcategory.

Auditing:     Rarely

Auditing not generally necessary since the most relevant information is already covered by other audit events.


Volume:     HighVery High

Volume depends on server type and system activity, but can potentially be very high on domain controllers.


Microsoft Documentation

Event ID - 4661



NameFieldInsertion StringOSExample
Security IDSubjectUserSid%1Any SOMEDOMAIN\UserOne
Account NameSubjectUserName%2Any UserOne
Account DomainSubjectDomainName%3Any SOMEDOMAIN
Logon IDSubjectLogonId%4Any 0x4290f
Object ServerObjectServer%5Any Security Account Manager
Object TypeObjectType%6Any SAM_DOMAIN
Object NameObjectName%7Any DC=somedomain,DC=local
Handle IDHandleId%8Any 0xdd64d85704
Transaction IDTransactionId%9Any {00000000-0000-0000-0000-000000000000}
AccessesAccessList%10Any ListAccounts
Access MaskAccessMask%11Any 0x2D
Privilege Used for Access CheckPrivilegeList%12Any View Codes
PropertiesProperties%13Any -
Restricted SID CountRestrictedSidCount%14Any 2949165
Process IDProcessId%15Any 0x7200a000e002d
Process NameProcessName%16Any


Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /category:"DS Access"



LEFT/RIGHT arrow keys for navigation

Back to List