Event ID 4656 errors when scanning file system with Symantec Endpoint Protection

Article:TECH190672  |  Created: 2012-06-08  |  Updated: 2013-01-25  |  Article URL http://www.symantec.com/docs/TECH190672
Article Type
Technical Solution

Environment

Issue



When running a scheduled scan with Symantec Endpoint Protection your Security Event Log fills up with Event ID 4656 entries.


Environment



Windows 2008 R2

Windows 7


Solution



“Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Object Access > Audit Handle Manipulation”


Switched this setting to “No auditing”
 




Article URL http://www.symantec.com/docs/TECH190672


Terms of use for this information are found in Legal Notices