Flooded with Event ID 4663

AndrewD84 41 Reputation points
2020-09-30T21:50:13.287+00:00

On a server 2016 and 2019 machine, I'm getting flooded with Event ID 4663 logs when the following group policy is enabled: Computer Config -> Windows Settings -> Security Settings -> Advanced Audit Policy Config -> Object Access -> Audit File System.

The logs I want to stop are being created by various EXE's (CMD.exe, Conhost.exe, etc) in the Windows folder being accessed by the AV installed on the computer. I will post an example of the log below.

My question is, why are these logs being generated when I do not have auditing enabled for the c:\windows folder enabled? If I look at properties -> security tab -> advanced -> auditing for c:\windows, its blank, not configured. If I choose disable inheritance in audit settings for the Windows folder, it does not stop the logs.

If I disable the policy for Audit File System, or if I disable AV software on the computer, these logs stop. But neither of these are an acceptable solution.

Is it that the Windows folder is automatically audited? What am I missing here? I'm getting flooded with about 50 audit logs a minute for a folder I have not enabled auditing on.

Example:

An attempt was made to access an object.

Subject:
Security ID: SYSTEM
Account Name: MERCURY$
Account Domain: GSI
Logon ID: 0x3E7

Object:
Object Server: Security
Object Type: File
Object Name: C:\Windows\System32\wbem\WmiPrvSE.exe
Handle ID: 0x1f8c
Resource Attributes: S:AI

Process Information:
Process ID: 0xa2c
Process Name: C:\Program Files\Bitdefender\Endpoint Security\epsecurityservice.exe

Access Request Information:
Accesses: WriteAttributes

Access Mask:        0x100

Thanks.

Windows Server Security
Windows Server Security
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
1,775 questions
0 comments
Accepted answer
  1. Vicky Wang 2,646 Reputation points
    2020-10-01T08:57:23.97+00:00

    Hi,

    What did you want to audit file or folder?

    If yes, you could use the Auditing of Advanced Security Settings in file or folder properties.

    For detailed information, please refer to the article below.

    Apply or Modify Auditing Policy Settings for a Local File or Folder

    https://technet.microsoft.com/en-us/library/cc771070(v=ws.11).aspx

    In addition, the Event ID 4663 is generated by you enable the audit policy Audit Removable Storage.

    Here is an article below about enable Audit Removable Storage for your reference.

    Monitor the Use of Removable Storage Devices

    https://technet.microsoft.com/en-us/library/jj574128(v=ws.11).aspx

    Best Regards,
    Vicky

    0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. AndrewD84 41 Reputation points
    2020-10-01T17:07:40.793+00:00

    The simplest explanation is usually the correct one.

    I was looking at auditing at the directory level, not the file level. Auditing was enabled on some individual EXE files, but not setup at the directory level.

    Thanks.

    0 comments