ZEKASTRA

SecurityProcess and object access

4663 · An attempt was made to access an object

Records that a specific access right was actually used on an audited object such as a file, registry key or kernel object.

01Fields in the event

  • SubjectUserSid
  • SubjectUserName
  • SubjectDomainName
  • SubjectLogonId
  • ObjectServer
  • ObjectType
  • ObjectName
  • HandleId
  • AccessList
  • AccessMask
  • ProcessId
  • ProcessName
  • ResourceAttributes

02How to use it

Use ObjectName, AccessList and ProcessName to show which process wrote to, deleted or changed permissions on a file. Link to 4656 through HandleId.

03Caveats

Generated only when the object's SACL contains a matching audit entry and the relevant subcategory (File System, Registry, Kernel Object or Removable Storage) is enabled. There is no failure variant.

05Sources

  1. Microsoft Learn — 4663(S) An attempt was made to access an object checked 2026-10-18

Contact and service requests

Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.