Windows Security Log Event ID 562

Operating Systems Windows Server 2000
Windows 2003 and XP
CategoryObject Access
Type Success
Corresponding events
in Windows 2008
and Vista		 4658  

562: Handle Closed

On this page

After successfully opening an object, a program eventually closes it which is documented by this event. Event 562 helps you determine how long the object was open. For this event to be useful you must link it back to the earlier event ID 560 with the same handle ID.

See event ID 560 for explanation of Process ID and Image File Name.

Microsoft's comments:

Always records as a success.

Free Security Log Resources by Randy

Description Fields in 562

  • Object Server:
  • Handle ID:
  • Process ID:

The following field also appears in Windows Server 2003:

  • Image File Name: (Path and file of program that accessed the object)

Supercharger Enterprise


 

Examples of 562

Handle Closed:
Object Server:Security
Handle ID:1468
Process ID:1688
Windows Server 2003 adds this field:
Image File Name:C:\WINDOWS\system32\notepad.exe

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection

Stay up-to-date on the Latest in Cybersecurity
Sign up for the Ultimate IT Security newsletter to hear about the latest webinars, patches, CVEs, attacks, and more.
Work Email:

 

Upcoming Webinars
Additional Resources

    Go To Event ID:

    Security Log
    Quick Reference
    Chart
    Download now!