Event ID 4670

Permissions on an object were changed

Permissions on an object were changed.

Subject:
    Security ID:        %1
    Account Name:       %2
    Account Domain:     %3
    Logon ID:           %4

Object:
    Object Server:      %5
    Object Type:        %6
    Object Name:        %7
    Handle ID:          %8

Process:
    Process ID:         %11
    Process Name:       %12

Permissions Change:
    Original Security Descriptor:   %9
    New Security Descriptor:        %10


Microsoft Documentation

Event ID - 4670



NameFieldInsertion StringOSExample
Security IDSubjectUserSid%1Any THEDOMAIN\UserOne
Account NameSubjectUserName%2Any UserOne
Account DomainSubjectDomainName%3Any THEDOMAIN
Logon IDSubjectLogonId%4Any 0x46857
Object ServerObjectServer%5Any Security
Object TypeObjectType%6Any File
Object NameObjectName%7Any C:\Files\info.txt
Handle IDHandleId%8Any 0x3f0
Original Security DescriptorOldSd%9Any D:AI(A;OICIID;FA;;;S-1-5-21-3457937927-2839227994-823803824-2104)(A;OICIID;FA;;;S-1-5-21-3457937927-2839227994-823803824-1104)(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)
New Security DescriptorNewSd%10Any D:ARAI(A;OICI;FA;;;WD)(A;OICIID;FA;;;S-1-5-21-3457937927-2839227994-823803824-2104)(A;OICIID;FA;;;S-1-5-21-3457937927-2839227994-823803824-1104)(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)
Process IDProcessId%11Any 0xdb0
Process NameProcessName%12Any C:\Windows\system32\dllhost.exe


Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /category:"Object Access"



LEFT/RIGHT arrow keys for navigation

Back to List