Event ID 4662
An operation was performed on an objectAn operation was performed on an object. Subject : Security ID: %1 Account Name: %2 Account Domain: %3 Logon ID: %4 Object: Object Server: %5 Object Type: %6 Object Name: %7 Handle ID: %9 Operation: Operation Type: %8 Accesses: %10 Access Mask: %11 Properties: %12 Additional Information: Parameter 1: %13 Parameter 2: %14
Auditing:
Conditional
Auditing is generally only recommended for AD replication troubleshooting or more detailed monitoring.
Volume:
High
Very High
Microsoft Documentation
Name | Field | Insertion String | OS | Example | ||
---|---|---|---|---|---|---|
Security ID | SubjectUserSid | %1 | Any | CORP\first.last | ||
Account Name | SubjectUserName | %2 | Any | first.last | ||
Account Domain | SubjectDomainName | %3 | Any | CORP | ||
Logon ID | SubjectLogonId | %4 | Any | 0x35867 | ||
Object Server | ObjectServer | %5 | Any | DS | ||
Object Type | ObjectType | %6 | Any | computer | ||
Object Name | ObjectName | %7 | Any | CN=MyComputer,CN=Users,DC=sierraclub,DC=local | ||
Operation Type | OperationType | %8 | Any | Object Access | ||
Handle ID | HandleId | %9 | Any | 0x0 | ||
Accesses | AccessList | %10 | Any | DELETE | ||
Access Mask | AccessMask | %11 | Any | View Codes | ||
Properties | Properties | %12 | Any | DELETE {b845b74-0d6b-9a34-b873-00aa003049a1 | ||
Parameter 1 | AdditionalInfo | %13 | Any | - | ||
Paramater 2 | Additional Info2 | %14 | Any |
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /subcategory:"Directory Service Access"
LEFT/RIGHT arrow keys for navigation
Back to List