Windows Security Log Event ID 4662

4662: An operation was performed on an object

On this page

• Description of this event
• Field level details
• Examples

Active Directory logs this event when a user accesses an AD object. 

Of course the object's audit policy must be enabled for the permissions requested and the user requesting it or a group to which that user belongs.

For tracking property level changes to AD objects I recommend using Directory Service Change events (5136...) instead of this event because 5136, etc provide much better information. 

On the other hand this is the only event that reports accesses defined for auditing that do not qualify as property changes. 

For instance changing the permissions on an OU such as for delegating administrative authority requires the WRITE_DAC permission which would get logged by this event.

Of course I don't recommend auditing read only accesses on AD objects since the value is questionable and would typically generate many, many events.  So on the whole I regard this event as noise and recommend disabling the "Directory Service Access" subcategory in your audit policy on domain controllers.

Free Security Log Resources by Randy

• Free Security Log Quick Reference Chart
• Windows Event Collection: Supercharger Free Edtion
• Free Active Directory Change Auditing Solution
• Free Course: Security Log Secrets

Description Fields in 4662

Subject:

The user and logon session that performed the action. 

• Security ID:  The SID of the account.
• Account Name: The account logon name.
• Account Domain: The domain or - in the case of local accounts - computer name.
• Logon ID: is a semi-unique (unique between reboots) number that identifies the logon session.  Logon ID allows you to correlate backwards to the logon event (4624) as well as with other events logged during the same logon session. 

Object:

This is the object upon whom the action was attempted.   

• Object Server: always "DS"
• Object Type: is the objectClass for the object as defined in the AD schema such as: user, group, groupPolicyContainer or organizationalUnit
• Object Name: The distinguished name of the object being accessed
• Handle ID: alwas 0x0 

Operation: 

• Operation Type: Object Access
• Accesses: "Write Property" or other AD permission used on this object
• Access Mask: bitwise represenation of Accesses:
• Properties: The GUIDs of the properties upon which each permission was excercised.

Additional Information:

• Parameter 1: always -
• Parameter 2: always blank

 

Supercharger Free Edition

Supercharger's built-in Xpath filters leave the noise behind.

Free.

 

Mini-Seminars Covering Event ID 4662 Monitoring Active Directory Changes for Compliance: Top 32 Security Events IDs to Watch and What They Mean 3 Modern Active Directory Attack Scenarios and How to Detect Them Managing Local Administrator Accounts with LAPS; And Protecting LAPS from Attack

 

Upcoming Webinars Assessing Your Active Directory: Group Related Risks

Additional Resources

•	Event IDs
•	All Event IDs
•	Audit Policy