Windows 10: How do I link Event IDs 4660 and 4663?

Hello,I have found a Python script that extracts IDs 4660 and 4663 and displays information such as computer name, user name, file and folder name, and time and date for files and folders. I want to know which file or folder was deleted by whom.The problem is that there is no file or folder name in ID 4660 and I need to extract the file or folder name from ID 4663, but how do I link these together? How do I know which ID 4660 is related to which ID 4663? What field is common between these IDs?Thank you.

:)

 

Windows Event 4660

Hello Everyone,

I'm trying actually to create a detection rule with Windows event 4660 to track any deleted object, file, directory or something like that. I know that this event is logged when an object is deleted. I checked that all the advanced audit policies are configured to Success and Failure to be able to collect the events, but when :

1. I created a new registry key and deleted it after that, event 4660 has not been logged;
   
2. I tried to deleted system registry keys but same thing;
   
3. I tried to delete files and directories but also same thing.
   

I want to know, why this event code is not generated ? Did I miss something or do something wrong ?

Need your help.

Thanks in advance.

 

Turn Off Auditing Event ID 4663 For Computer Account

Hello,

We are trying to reduce log volumes and we have a very noisy computer account that is generating millions of 4663 a day. I cannot for the life of me figure out a way to turn auditing off for this specific account and event. I tried looking in to SACL but
couldn't find a way to properly do it. If anyone could please help guide me in how to do something like this it would be greatly appreciated.

 

Event ID 10016, CLSID and APPID

Hey, I've been trying to resolve this same dcom issue myself, and I followed the steps you listed @FreeBooter, but when I try to do the last step, I firstly when clicking "edit" get a message saying



And then when I do enter the menu after clicking "ok" on that dialog box, the add button is greyed out.

I'm 100% certain I followed all the steps correctly. I triple-checked it. But no dice...