Windows 10: A question about Event ID 4660

Hello,I want to send Windows Event Logs to a Grafana server and analyze it. My goal is to know which file or folder was deleted by whom and on what date and time. The ID for the deleted file or folder is 4660, but this ID does not include the file or folder name.What is the solution?Thank you.

:)

 

Windows Event 4660

Hello Everyone,

I'm trying actually to create a detection rule with Windows event 4660 to track any deleted object, file, directory or something like that. I know that this event is logged when an object is deleted. I checked that all the advanced audit policies are configured to Success and Failure to be able to collect the events, but when :

1. I created a new registry key and deleted it after that, event 4660 has not been logged;
   
2. I tried to deleted system registry keys but same thing;
   
3. I tried to delete files and directories but also same thing.
   

I want to know, why this event code is not generated ? Did I miss something or do something wrong ?

Need your help.

Thanks in advance.

 

Kernel-Power event id 41. BugcheckCode 0

Hello,

Thank you for writing to Microsoft Community Forums.

In-order to get more clarity on this issue and to assist you with appropriate troubleshooting steps, reply with answers to the below questions:

1. Are you aware of any changes made on your PC, prior to this issue?
   
2. Is this issue specific while playing a particular game?
   
3. Which edition of Windows are you currently using?
   

A Kernel Power Event 41 can occur in the following scenarios.

Scenario 1: The computer restarts, and there is a Stop error BugcheckCode in the event data.

Scenario 2: The computer is shut down by pressing and holding the power button.

Scenario 3: The system randomly restarts and no Stop error BugcheckCode is listed, or the computer is completely unresponsive (hard hang).

I suggest you refer the article on Kernel
Power Event ID 41 and follow the steps for the scenario that is causing this error on your PC.

Additionally, you can refer the article on Windows
Kernel event ID 41 error "The system has rebooted without cleanly shutting down first" in Windows
and check if that helps.

Regards,

Sandeep Kumar M

Microsoft Community – Moderator

 

Event ID 10016, CLSID and APPID

Hey, I've been trying to resolve this same dcom issue myself, and I followed the steps you listed @FreeBooter, but when I try to do the last step, I firstly when clicking "edit" get a message saying



And then when I do enter the menu after clicking "ok" on that dialog box, the add button is greyed out.

I'm 100% certain I followed all the steps correctly. I triple-checked it. But no dice...