Event ID: 4664

An attempt was made to create a hard link

An attempt was made to create a hard link.

Subject:
    Account Name:       %1
    Account Name:       %2
    Account Domain:     %3
    Logon ID:           %4

Link Information:
    File Name:          %5
    Link Name:          %6
    Transaction ID:     %7
Microsoft Documentation

Event ID - 4664





Name Field Insertion String OS Example
Account Name SubjectUserSid %1 Any THEDOMAIN\UserOne
Account Name SubjectUserName %2 Any UserOne
Account Domain SubjectDomainName %3 Any THEDOMAIN
Logon ID SubjectLogonId %4 Any 0x43954
File Name FileName %5 Any C:\Windows\notepad.exe
Link Name LinkName %6 Any C:\Users\UserTwo\editor.exe
Transaction ID TransactionId %7 Any {00000000-0000-0000-0000-000000000000}


Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"File System"
How to enable Windows Auditing



LEFT/RIGHT arrow keys for navigation

Back to List