Real-time, web based Active Directory Change Auditing and Reporting Solution by ManageEngine ADAudit Plus (2024)

Event ID 4660 – An Object Was Deleted

Event ID 4660 is logged when an object is deleted. The audit policy of the object must have auditing enabled for deletions by that particular user or group. Event 4660 can be correlated to event 4656 as they share the same handle ID. The deletion of an object triggers both this event, as well as event 4663.

This log data provides the following information:

• Security ID
• Account Name
• Account Domain
• Logon ID
• Object Server
• Handle ID
• Process ID
• Transaction ID

Why does event ID 4660 need to be monitored?

• To track the deletion of files and other Windows objects, this should be monitored in tandem with 4663, as this event does not provide the Object Name
• To prevent privilege abuse
• To detect abnormal and potentially malicious activity
• To ensure compliance with regulatory mandates

Pro Tip:

ADAudit Plus provides real-time pre-configured reports and auditing of the changes along with alerts within a Domain & OU. The advanced Group Policy settings real-time audit reports provide detailed information about object related events.

Account Management Auditing

• Track User Administrators
• User Management Reports
• Insider Threat Detection

Active Directory Auditing

• Monitor User Logon Actions
• GPO Settings Auditing
• IT Compliance Auditing

Windows Server Auditing

• Windows Member Server Auditing
• Windows File Integrity Monitoring
• Security Eventlog Monitoring

• Related Products
  • ADManager Plus Active Directory Management & Reporting
  • ADAudit Plus Real-time Active Directory Auditing and UBA
  • EventLog Analyzer Real-time Log Analysis & Reporting
  • ADSelfService Plus Self-Service Password Management
  • AD360 Integrated Identity & Access Management
  • Log360 (On-Premise | Cloud) Comprehensive SIEM and UEBA
  • AD Free Tools Active Directory FREE Tools