- windows server 2012R2
- auditpol /set /subcategory:"Handle Manipulation" /Success:Disabled /Failure:Disabled
- still getting events 4656 "A handle to an object was requested."
any ideas?
Asked
Active
Viewed 869 times
1
userfault
- 23
- 3
-
Is the server in an AD domain? – Ryan Ries Apr 07 '15 at 21:33
-
yes it's the dc – userfault Apr 07 '15 at 21:38
-
Do you have any Group Policy auditing settings that may taking precedence over your auditpol command? Also, the command you typed in will not work. It's `disable`, not `disabled`... using the past tense of the word is a syntax error. – Ryan Ries Apr 07 '15 at 21:41
-
regarding the typo, i typed the text above from memory, didn't copy paste. wherein the server it's configured correctly. as for the gpo settings everything seems fine. – userfault Apr 07 '15 at 21:44
-
ok there's some progress, i found that when i disable "Audit File System" then event 4656 disappears. so the question is, should this event be generated by "Audit File System" setting??? – userfault Apr 07 '15 at 21:47