Event ID 4660: An Object was Deleted [Fix]

A few of our readers have come across event ID 4660. They often are unsure what to make of it, so we explain in this guide.

The event ID 4660 is often logged when an object is deleted, so we will also explore some practical ways to fix it on your computers.

What is event ID 4660?

The event ID 4660 is related to objects on the Active Directory and will be triggered by any of the following:

• Object deletion – A security event with event ID 4660 is recorded whenever an object is deleted from Active Directory.
• Manual changes – When a user or administrator manually changes an object’s permissions, Event ID 4660 may be generated. This may occur while altering permission settings, modifying access levels, or adding or deleting people or groups.
• Malicious activity – The event ID may also happen if someone attempting to change an object’s rights does so with illegal access. This can signify a security lapse or an effort to access confidential files or folders without authorization.
• System updates – To improve security or address vulnerabilities, certain system upgrades, such as Windows updates or security patches, may change the rights of particular objects triggering the event ID.
• Software installations – Some software installations may modify permissions on specific files or folders as part of the installation process.

How do I fix event ID 4660?

First, you may try these easy workarounds:

• Uninstall recently installed applications, as they may have changed specific object values during installation.
• Scan for viruses to reduce the chances of the event ID due to malware changes.

If the error is evident after these prefixes, proceed to the solutions below.

1. Restore the object from a backup

1. Open the Active Directory Users and Computers console.
2. Locate the object you want to restore, right-click the object, and select Restore.
   
3. Follow the on-screen instructions to restore the object.

2. Roll back updates

1. .Press Windows + I to open the Settings app.
2. On the left pane, click Windows update, then click Update history on the right.
   
3. Select Uninstall updates.
   
4. Click the Uninstall button to remove any updates made.
   
5. Finally, start the computer and verify if it fixes the event ID 4660.

3. Perform a system restore

1. Press Windows + R, type rstrui, and hit Enter.
   
2. Select Choose a different restore point and hit Next.
   
3. Select a restore point and click Next.
   
4. Finally, click Finish and verify it fixes event ID 4660.

In the future, you may prevent the event ID by implementing a strong security policy. A strong security policy can help to prevent unauthorized access to your system.

Additionally, we recommend backing up your system regularly, as it can help you restore objects deleted by malicious users or hardware failures and use a robust antivirus.

That is all we have to share in this article. If you have additional questions, leave us a comment in the comment section below, and we will respond.