Event ID 4691 – Indirect Access To An Object Was Requested
|Category||Object Access: Other Object Access Events|
|Description||Indirect access to an object was requested.|
Event 4691 is generated when indirect permission to an object is sought. This is usually applicable to ALPC Ports access request actions.
This log data provides the following information:
- Security ID
- Account Name
- Account Domain
- Logon ID
- Object Type
- Object Name
- Process ID
- Access Mask
Why does event ID 4691 need to be monitored?
- To monitor actions of ALPC Ports
- To prevent privilege abuse
- To detect abnormal and potentially malicious activity
- To ensure compliance with regulatory mandates
ADAudit Plus provides real-time pre-configured reports and auditing of the changes along with alerts within a Domain & OU. The advanced Group Policy settings real-time audit reports provide detailed information about object related events.
Event 4691 applies to the following operating systems:
- Windows 2008 R2 and 7
- Windows 2012 R2 and 8.1
- Windows 2016 and 10