Event ID 4656 errors when scanning file system with Symantec Endpoint Protection

Article:TECH190672  |  Created: 2012-06-08  |  Updated: 2013-01-25  |  Article URL http://www.symantec.com/docs/TECH190672
Article Type
Technical Solution



When running a scheduled scan with Symantec Endpoint Protection your Security Event Log fills up with Event ID 4656 entries.


Windows 2008 R2

Windows 7


“Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Object Access > Audit Handle Manipulation”

Switched this setting to “No auditing”

Article URL http://www.symantec.com/docs/TECH190672

Terms of use for this information are found in Legal Notices