Windows Security Log Event ID 4664

Operating Systems Windows 2008 R2 and 7
Windows 2012 R2 and 8.1
Windows 2016 and 10
Windows Server 2019 and 2022
Category
 • Subcategory
Object Access
 • File System
Type Success
Corresponding events
in Windows 2003
and before
 

4664: An attempt was made to create a hard link

On this page

An attempt was made to create a hard link.

A hard link is a pointer to a file on the same system.

Free Security Log Resources by Randy

Description Fields in 4664

Subject:

  • Account Name:
  • Account Name:
  • Account Domain:
  • Logon ID:

Link Information:

  • File Name:
  • Link Name:
  • Transaction ID:

Supercharger Enterprise


Load Balancing for Windows Event Collection

 

Examples of 4664

An attempt was made to create a hard link.

Subject:
  Account Name:  SYSTEM
  Account Name:  LABMS$
  Account Domain:  LAB
  Logon ID:  0x3e7

Link Information:
  File Name: C:\Windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_6.0.6001.18183_none_12ef96002267a3d0\mshtml.tlb
  Link Name: C:\Windows\System32\mshtml.tlb
  Transaction ID: {4185d0f7-d5b9-11dd-a7c2-000c29b41689}

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection



 

Upcoming Webinars
    Additional Resources

      Go To Event ID:

      Security Log
      Quick Reference
      Chart
      Download now!