ZEKASTRA

SecurityProcess and object access

4656 · A handle to an object was requested

Records a request to open a handle to an audited object and whether it was granted. A failure event is generated when access is declined.

01Fields in the event

  • SubjectUserSid
  • SubjectUserName
  • SubjectDomainName
  • SubjectLogonId
  • ObjectServer
  • ObjectType
  • ObjectName
  • HandleId
  • TransactionId
  • AccessList
  • AccessReason
  • AccessMask
  • PrivilegeList
  • RestrictedSidCount
  • ProcessId
  • ProcessName
  • ResourceAttributes

02How to use it

Failures show attempted access that was blocked. For successes, look for a matching 4663 with the same HandleId to show that the access was actually used.

03Caveats

A requested handle does not prove that the operation happened. Requires a matching SACL entry and the relevant object-access subcategory.

05Sources

  1. Microsoft Learn — 4656(S, F) A handle to an object was requested checked 2026-10-18

Contact and service requests

Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.