Fix: Event ID 4663, An Attempt Was Made to Access An Object

Event 4663 may indicate that a user has logged on to a domain computer using an account that is not authorized to be used to log on to the domain. This can occur if the account was disabled or removed from the Domain Admins group.

If you see this error regularly, it could be related to permissions on shared folders or drives and/or improperly configured user accounts with insufficient access rights. Still, it’s worth checking out because if left unattended, the user may gain access.

What is Event ID 4663?

Event ID 4663 is logged when a particular operation is performed on an object. This event can be viewed in the Security log and has a target of the security log. The Event ID 4663 will be recorded in the security log when a user attempts to perform an operation that requires administrator permissions.

The main categories of object types are as follows:

• File system objects (for example, files, folders, or printers)
• Kernel objects (for example, processes and threads)
• Registry objects (for example, keys and values)
• System objects (for example, drivers)
• Objects on removable storage or devices

An attempt was made to access an object could mean:

• Object is no longer present on the server – If you are having trouble accessing a file or folder, it means that this file or folder was deleted from the server.
• The object is present on the server, but its name is not valid – It’s possible that the object may have been deleted or renamed since it was last accessed. 
• Object is present on the server, but in a different location – This error can occur if you try to access a file or folder that has been moved or renamed. 
• The object is present on the server, but your account does not have access rights – This error occurs when your user account does not have sufficient read/write privileges for you to do so.

How can I fix Event ID 4663?

First off, ensure you check the following:

• Turn on your firewall to ensure unauthorized access is limited. Also, check out what to do if you’re unable to turn on Windows Firewall.
• Check whether there’s a misconfiguration of the SACL (System Access Control List), which prevents users from accessing objects they should be allowed to.

1. Check and remove Event logs

1. Click on the Windows Search icon on the taskbar, type Event Viewer and click Open.
2. Navigate to the left-hand pane, expand the Windows Logs menu and select Security.
3. Scroll through the various logs and locate one with Event ID 4663. 
4. Once you locate a log with Event ID 4663, make note of the Account Name that attempted to log in
5. Bring up the Search icon again, type Control Panel and click Open.
6. Select User Accounts.
7. Click on Manage your credentials on the left-hand side.
8. Select Windows Credentials in the new window.
9. Expand the unfamiliar user account, and in the drop-down menu, click Remove to get rid of that user.

The Event ID 4663 attempt may be due to an internal or external security breach, and a user account is being used by malicious software to access the system. This account may have been created by malware or by an attacker exploiting a vulnerability in network services.

2. Disable remote access

1. Hit the Windows key and click on Settings.
2. Click on the System tab and scroll down to Remote Desktop.
3. Toggle the switch next to Remote Desktop to disable the feature.
4. Next, hit the Windows + R keys to open the Run command.
5. Type regedit in the dialog box and hit Enter to open the Registry Editor. Select Yes if the User Account Control asks if you want to make any changes.
6. Navigate to the following location: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server
7. Double-click on fDenyTSConnections on the right pane to open it.
8. Set the Value data to 1, then click OK to finish up.

A Windows server can be accessed remotely if it is running a service. For example, if you want to access your server via Remote Desktop, you need to enable this feature.

Disabling remote access should be a temporary security measure until you determine whether the Event ID 4663 is a brute-force attack.

Read more about this topic

• Microsoft says that installing Copilot in Windows Server was just a mistake
• Reviews suggest Windows Server Backup is not the most reliable option, users prefer alternatives
• Leaked beta build screenshots of Microsoft Server 2012 showcase what could have been
• Copilot is getting installed (again) on Windows Server, but you can get rid of it with this policy setting

That’s all we had for this Event ID, but check out what we have in store. For instance, the Event ID 4648, where a logon using credentials was attempted, or Event 4502 that is related to WinREAgent.

Share any additional thoughts on this topic in the comment section below.