UltimateWindowsSecurity.com Forum / Ultimate Windows Security Forum / Security Log / 560 - Object Open / How to manage Handle ID for event 560, 567 and 562 / Latest PostsInstantForum.NET v4.1.4UltimateWindowsSecurity.com Forumhttp://forum.ultimatewindowssecurity.com/noreply@ultimatewindowssecurity.comTue, 07 Feb 2012 12:25:49 GMT20RE: How to manage Handle ID for event 560, 567 and 562http://forum.ultimatewindowssecurity.com/Topic302-36-1.aspxwelcomeSat, 28 Aug 2010 16:49:36 GMTRandyFranklinSmithRE: How to manage Handle ID for event 560, 567 and 562http://forum.ultimatewindowssecurity.com/Topic302-36-1.aspxThanx for your help!</P><P><EM>Alessandro Rimoldi (KBE Srl - Milano, Italia)</EM>Wed, 17 Mar 2010 06:41:53 GMTAlessandroRimoldiRE: How to manage Handle ID for event 560, 567 and 562http://forum.ultimatewindowssecurity.com/Topic302-36-1.aspxYou are correct, it's only unique between reboots. Wed, 10 Mar 2010 17:31:14 GMTRandyFranklinSmithHow to manage Handle ID for event 560, 567 and 562http://forum.ultimatewindowssecurity.com/Topic302-36-1.aspxGood evening,</P><P>i'm trying to correlate more events with ID 560, 567 and 562 using the "Handle ID" but i found that the value assigned to "Handle ID" is not unique because is unique until reboot of the server/machine.</P><P>So, after a reboot of the server/machine i can see in event viewer an operation with the same "Handle ID" used before the reboot so i can't define into a database that an operation with a particular "Handle ID" is referred to a particular Username (because the same "Handle ID" can be used for operations of another user after the reboot).</P><P>In witch way the operating system determine the "Handle ID"? I noticed that is a numeric code: after witch value it restart to count from 0?</P><P>Thanks for help!</P><P>Alessandro Rimoldi (Milan, Italy)Mon, 25 Jan 2010 12:22:01 GMTAlessandroRimoldi