Audit handle manipulation

Double-click Security Settings, double-click Advanced Audit Policy Configuration, and then double-click Audit Policies

Double-click Object Access, and then double-click Audit File System

Select the Configure the following events check box, select the Success and Failure check boxes, and then click OK

Typically, information about the duplication or closing of an object handle has little to no security relevance and is hard to parse or analyze

There is no recommendation to enable this subcategory for Success or Failure auditing, unless you know exactly what you need to monitor in Object’s Handles level

Audit Handle Manipulation enables generation of “4658: The handle to an object was closed” in Audit File System, Audit Kernel Object, Audit Registry, Audit Removable Storage and Audit SAM subcategories, and shows object’s handle duplication and close actions