Event ID: 560

Object Open

Object Open:
    Object Server:        %1
    Object Type:          %2
    Object Name:          %3
    Handle ID:            %4
    Operation ID:         %5
    Process ID:           %6
    Image File Name:      %7
    Primary User Name:    %8
    Primary Domain:       %9
    Primary Logon ID:     %10
    Client User Name:     %11
    Client Domain:        %12
    Client Logon ID:      %13
    Accesses:             %14
    Privileges:           %15
    Restricted Sid Count: %16
    Access Mask:          %17


Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /category:"Object Access"
How to enable Windows Auditing


Audit Category:
Object Access
Corresponding Events:
4656


LEFT/RIGHT arrow keys for navigation

Back to List