October 2006 - Posts

How are object access events generated?
26 October 06 10:21 AM | Eric Fitzgerald | 2 Comments   
I wrote this as an answer for Tom, who emailed me, but I thought I'd share it with everyone. There are 7 events associated with object access auditing in Windows: 560 is the "open handle" event. It is logged when an app asks for access to an object (via Read More...
Filed under: ,
Page view tracker