Event ID 4664

An attempt was made to create a hard link

An attempt was made to create a hard link.

Subject:
    Account Name:       %1
    Account Name:       %2
    Account Domain:     %3
    Logon ID:           %4

Link Information:
    File Name:          %5
    Link Name:          %6
    Transaction ID:     %7


Microsoft Documentation

Event ID - 4664



NameFieldInsertion StringOSExample
Account NameSubjectUserSid%1Any THEDOMAIN\UserOne
Account NameSubjectUserName%2Any UserOne
Account DomainSubjectDomainName%3Any THEDOMAIN
Logon IDSubjectLogonId%4Any 0x43954
File NameFileName%5Any C:\Windows\notepad.exe
Link NameLinkName%6Any C:\Users\UserTwo\editor.exe
Transaction IDTransactionId%7Any {00000000-0000-0000-0000-000000000000}


Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"File System"



LEFT/RIGHT arrow keys for navigation

Back to List