Event ID 560
Object OpenObject Open: Object Server: %1 Object Type: %2 Object Name: %3 Handle ID: %4 Operation ID: %5 Process ID: %6 Image File Name: %7 Primary User Name: %8 Primary Domain: %9 Primary Logon ID: %10 Client User Name: %11 Client Domain: %12 Client Logon ID: %13 Accesses: %14 Privileges: %15 Restricted Sid Count: %16 Access Mask: %17
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /category:"Object Access"
Audit Category:
Object AccessLEFT/RIGHT arrow keys for navigation
Back to List