Navigation section
id 4663
About this tag
This tag covers Windows security event ID 4663, which logs attempts to access an object such as a file, folder, or registry key. Discussions focus on correlating ID 4663 with ID 4660 to determine which user deleted a specific file or folder. Users seek to identify common fields between these event IDs to link deletion actions to user accounts. The tag is relevant for IT administrators and security professionals who need to audit file access and deletions in Windows environments using Event Viewer or advanced log analysis.
-
H
Windows 10 What fields are common between IDs 4660 and 4663?
Hello, I want to know which file or folder was deleted by whom. The problem is that there is no file or folder name in ID 4660 and I need to extract the file or folder name from ID 4663, but how do I link these together? How do I know which ID 4660 is related to which ID 4663? What field is...- hack3rcon
- Thread
- audit logs data recovery error resolution event correlation event id file deletion file management file monitoring file system folder deletion folder tracking id 4660 id 4663 james jason security audits user activity windows logs windows security
- Replies: 3
- Forum: Windows Help and Support