Event ID 595
Indirect access to an object has been obtainedIndirect access to an object has been obtained:
Object Type: %1
Object Name: %2
Process ID: %3
Primary User Name: %4
Primary Domain: %5
Primary Logon ID: %6
Client User Name: %7
Client Domain: %8
Client Logon ID: %9
Accesses: %10
Access Mask: %11Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /category:"Detailed Tracking"
Audit Category:
Detailed TrackingLEFT/RIGHT arrow keys for navigation
Back to List