deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-06-22 13:53:39 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

fixing spacing issues

Browse Source
This commit is contained in:
Brian Lich
2016-05-19 14:52:11 -07:00
parent bfa34cacc3
commit eb9290389d
85 changed files with 2243 additions and 3427 deletions
Download Patch File Download Diff File Expand all files Collapse all files

91
windows/keep-secure/audit-other-object-access-events.md
View File

@ -2,92 +2,55 @@
title: Audit Other Object Access Events (Windows 10)
description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Other Object Access Events, which determines whether the operating system generates audit events for the management of Task Scheduler jobs or COM+ objects.
ms.assetid: b9774595-595d-4199-b0c5-8dbc12b6c8b2
ms.pagetype: security
ms.prod: W10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
---
# Audit Other Object Access Events
**Applies to**
- Windows 10
This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Other Object Access Events**, which determines whether the operating system generates audit events for the management of Task Scheduler jobs or COM+ objects.
For scheduler jobs, the following actions are audited:
- Job created.
- Job deleted.
- Job enabled.
- Job disabled.
- Job updated.
For COM+ objects, the following actions are audited:
- Catalog object added.
- Catalog object updated.
- Catalog object deleted.
Event volume: Low
Default: Not configured
<table>
<colgroup>
<col width="50%" />
<col width="50%" />
</colgroup>
<thead>
<tr class="header">
<th align="left">Event ID</th>
<th align="left">Event message</th>
</tr>
</thead>
<tbody>
<tr class="odd">
<td align="left"><p>4671</p></td>
<td align="left"><p>An application attempted to access a blocked ordinal through the TBS.</p></td>
</tr>
<tr class="even">
<td align="left"><p>4691</p></td>
<td align="left"><p>Indirect access to an object was requested.</p></td>
</tr>
<tr class="odd">
<td align="left"><p>4698</p></td>
<td align="left"><p>A scheduled task was created.</p></td>
</tr>
<tr class="even">
<td align="left"><p>4699</p></td>
<td align="left"><p>A scheduled task was deleted.</p></td>
</tr>
<tr class="odd">
<td align="left"><p>4700</p></td>
<td align="left"><p>A scheduled task was enabled.</p></td>
</tr>
<tr class="even">
<td align="left"><p>4701</p></td>
<td align="left"><p>A scheduled task was disabled.</p></td>
</tr>
<tr class="odd">
<td align="left"><p>4702</p></td>
<td align="left"><p>A scheduled task was updated.</p></td>
</tr>
<tr class="even">
<td align="left"><p>5148</p></td>
<td align="left"><p>The Windows Filtering Platform has detected a DoS attack and entered a defensive mode; packets associated with this attack will be discarded.</p></td>
</tr>
<tr class="odd">
<td align="left"><p>5149</p></td>
<td align="left"><p>The DoS attack has subsided and normal processing is being resumed.</p></td>
</tr>
<tr class="even">
<td align="left"><p>5888</p></td>
<td align="left"><p>An object in the COM+ Catalog was modified.</p></td>
</tr>
<tr class="odd">
<td align="left"><p>5889</p></td>
<td align="left"><p>An object was deleted from the COM+ Catalog.</p></td>
</tr>
<tr class="even">
<td align="left"><p>5890</p></td>
<td align="left"><p>An object was added to the COM+ Catalog.</p></td>
</tr>
</tbody>
</table>
| Event ID | Event message |
| - | - |
| 4671 | An application attempted to access a blocked ordinal through the TBS. |
| 4691 | Indirect access to an object was requested. |
| 4698 | A scheduled task was created. |
| 4699 | A scheduled task was deleted. |
| 4700 | A scheduled task was enabled. |
| 4701 | A scheduled task was disabled. |
| 4702 | A scheduled task was updated. |
| 5148 | The Windows Filtering Platform has detected a DoS attack and entered a defensive mode; packets associated with this attack will be discarded. |
| 5149 | The DoS attack has subsided and normal processing is being resumed. |
| 5888 | An object in the COM+ Catalog was modified. |
| 5889 | An object was deleted from the COM+ Catalog. |
| 5890 | An object was added to the COM+ Catalog. |
 
## Related topics
[Advanced security audit policy settings](advanced-security-audit-policy-settings.md)
- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)