Solved

Parameters list in Security Event ID 4663

Posted on 2013-12-10
4
932 Views
Last Modified: 2013-12-10
I'm trying to alert when files are deleted in a folder. I turned on auditing for deletes and I see event id 4663 in the security log.  I'm using SCOM 2012 to comb the event log.  

What I need to know is what is the parameters values for this alert.

Specifically, what parameter value is the "DELETE" value.
 

Access Request Information:
      Accesses:      DELETE
0
Comment
Question by:jalenk
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
4 Comments
 
LVL 19

Accepted Solution

by:
jss1199 earned 500 total points
ID: 39710165
String01 – Object Type
String02 – Object Name
String03 – Process ID
String04 - Process Name
String05 – Accesses
String06 – Object Server
String07 – Handle ID
String08 – Transaction ID
String09 – Access Mask
String10 – Privileges Used for Access Check
String11 – Restricted SID Count

For your example, you want alert when String 05 contains DELETE
0
 

Author Comment

by:jalenk
ID: 39710170
Thanks.  How did you figure that out? I'll need the same list for event id 4660
0
 

Author Closing Comment

by:jalenk
ID: 39710173
quick!
0
 
LVL 19

Expert Comment

by:jss1199
ID: 39710227
I have it memorized from years of SCOM and ACS :)

The easiest way is to open the event you are concerned about in event viewer, select the copy command.  Paste the contents into notepad and you will have the XMLdata of the event.

If you look under the EventData section, you'll notice a number of <Data Name=".... Each of those is a string and can be referred to as String01, String02, String03, in order, until you reach the end..
0

Featured Post

Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

When you upgrade from Windows 8 to 8.1 or to Windows 10 or if you are like me you are on the Insider Program you may find yourself with many 450MB recovery partitions.  With a traditional disk that may not be a problem but with relatively smaller SS…
New Windows 7 Installations take days for Windows-Updates to show up and install. This can easily be fixed. I have finally decided to write an article because this seems to get asked several times a day lately. This Article and the Links apply to…
This tutorial will show how to push an installation of Backup Exec to an additional server in both 2012 and 2014 versions of the software. Click on the Backup Exec button in the upper left corner. From here, select Installation and Licensing, then I…
This tutorial will give a an overview on how to deploy remote agents in Backup Exec 2012 to new servers. Click on the Backup Exec button in the upper left corner. From here, are global settings for the application such as connecting to a remote Back…

726 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question