Event Message:

Object Open for Delete: Object Server: computer name Object Type: parameter Object Name: name New Handle ID: parameter Operation ID: \{parameter,parameter\} Process ID: parameter Primary User Name: user name Primary Domain: name Primary Logon ID: computer name0 Client User Name: user name Client Domain: name Client Logon ID: computer name3 Accesses computer name4 Privileges computer name5

Explanation:

This event record indicates that an object has been opened with the intent to delete the object. The only way to determine what happened to the object is to look at the Object Name in the audit log. This message does not mean that the object was deleted. The log will show what action occurred. Note: There are security implications to this action if the object name represents a file containing sensitive data.

User Action:

If the specified object name represents a file containing sensitive data, make sure the specified user was supposed to have access to the file.