Navigation section

jason

About this tag
The tag jason on WindowsForum.com covers discussions about Windows security event IDs 4660 and 4663, specifically how to correlate them to identify which user deleted a file or folder. In one thread, a user named Jason is used as an example to illustrate the challenge of linking these event IDs to determine the deleting user and the affected file. The tag is relevant for IT professionals and system administrators working with Windows auditing and security logs.
  1. H

    Windows 10 What fields are common between IDs 4660 and 4663?

    Hello, I want to know which file or folder was deleted by whom. The problem is that there is no file or folder name in ID 4660 and I need to extract the file or folder name from ID 4663, but how do I link these together? How do I know which ID 4660 is related to which ID 4663? What field is...
    • hack3rcon
    • Thread
    • audit logs data recovery error resolution event correlation event id file deletion file management file monitoring file system folder deletion folder tracking id 4660 id 4663 james jason permissions security audits user activity windows logs windows security
    • Replies: 3
    • Forum: Windows Help and Support
Back
Top