Event ID 4663 — Access to an audited object

A process accessed a file, folder or other object whose audit is enabled.

Source of event

Microsoft-Windows-Security-Auditing — Security category.

Possible causes

• Reading or legitimate modification
• Administrative access
• Suspicious activity according to object

Verifications to be carried out

1. Identify Object Name
2. Read Accesses
3. Identify Process Name and Account

Useful orders….

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4663} -MaxEvents 50

To be retained….

An Event ID must always be interpreted with its source, its full message, its timing and the context of the system. The same number may exist in several providers of events.