Event ID 563
Object Open for DeleteObject Open for Delete:
Object Server: %1
Object Type: %2
Object Name: %3
Handle ID: %4
Operation ID: {%5,%6}
Process ID: %7
Primary User Name: %8
Primary Domain: %9
Primary Logon ID: %10
Client User Name: %11
Client Domain: %12
Client Logon ID: %13
Accesses: %14
Privileges: %15
Access Mask: %16Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /category:"Object Access"
Audit Category:
Object AccessLEFT/RIGHT arrow keys for navigation
Back to List