Forum

i'm trying to correlate more events with ID 560, 567 and 562 using the "Handle ID" but i found that the value assigned to "Handle ID" is not unique because is unique until reboot of the server/machine.

So, after a reboot of the server/machine i can see in event viewer an operation with the same "Handle ID" used before the reboot so i can't define into a database that an operation with a particular "Handle ID" is referred to a particular Username (because the same "Handle ID" can be used for operations of another user after the reboot).

In witch way the operating system determine the "Handle ID"? I noticed that is a numeric code: after witch value it restart to count from 0?

Thanks for help!

Alessandro Rimoldi (Milan, Italy)

Alessandro Rimoldi (KBE Srl - Milano, Italia)