Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I found 141 PlugPlayManager Security Audit Failures logged within the same minute on one of our Server 2008 R2 servers (running only SQL 2008 R2). While Googling all I could find was other people, asking the same question and never receiving an answer. But then, they didn't ask their question at ServerFault....

What would cause so many EventID 4656 PlugPlayManager Security Audit Failures at one time?


<Event xmlns="">
        <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> 
        <TimeCreated SystemTime="2012-10-25T15:16:38.739237000Z" /> 
        <Correlation /> 
        <Execution ProcessID="544" ThreadID="552" /> 
        <Security /> 
        <Data Name="SubjectUserSid">S-1-5-21-##########-##########-#########-####</Data> 
        <Data Name="SubjectUserName">MyUser</Data> 
        <Data Name="SubjectDomainName"></Data> 
        <Data Name="SubjectLogonId">0x#######</Data> 
        <Data Name="ObjectServer">PlugPlayManager</Data> 
        <Data Name="ObjectType">Security</Data> 
        <Data Name="ObjectName">PlugPlaySecurityObject</Data> 
        <Data Name="HandleId">0x0</Data> 
        <Data Name="TransactionId">{00000000-0000-0000-0000-000000000000}</Data> 
        <Data Name="AccessList">%%1553</Data> 
        <Data Name="AccessReason">-</Data> 
        <Data Name="AccessMask">0x2</Data> 
        <Data Name="PrivilegeList">-</Data> 
        <Data Name="RestrictedSidCount">0</Data> 
        <Data Name="ProcessId">0x28c</Data> 
        <Data Name="ProcessName">C:\Windows\System32\svchost.exe</Data> 

If it helps any, process# 544 was lsass.exe and thread# 552 showed a start address of "ntdll.dll!RtUserThreadStart" in Process Explorer.

share|improve this question
up vote 2 down vote accepted

You can refer this blog

Possible Solution:

Event 4656 should occur if the Success or Failure audit was enabled for Handle Manipulation using command line tool Auditpol.

Subcategory: Handle Manipulation

You will get following three Event IDs if Handle Manipulation enabled

  • 4656 A handle to an object was requested.
  • 4658 The handle to an object was closed.
  • 4690 An attempt was made to duplicate a handle to an object.

If you would like to get rid of these Object Access event 4656 then you need to run the following command:

Auditpol /set /subcategory:"Handle Manipulation" /Failure:disable
share|improve this answer
So basically, "If you find those important security warnings annoying, turn them off." Any idea what the default is for recording Handle Manipulation? It turns out we are turning on auditing for both Success and Failure, via Group Policy. But I do not know what the settings would be without that policy. – Nathan Hartley Aug 16 '13 at 15:36
1.Have you checked the setting Handle Manipulation in Local Security policy? you can open it by running command secedit.msc. If it is ok. then run the command Auditpol /get /subcategory:"Handle Manipulation" and ensure whether the Setting value is Not Auditing ot Not Configured – dada Aug 16 '13 at 18:10

Currently, under Server 2012 R2 events 4656 will generate even if Handle Manipulation category is disabled. In our case, we have enabled Audit File System category which was only generating 4660-4663 events on previous Server versions (2008-2008R2-2012) but on Server 2012 R2 this initiates overwhelming flow of 4656 events. The issue has been reported to Microsoft however there is no resolution yet.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.