Event Message:

A handle to an object has been duplicated: Source Handle ID: parameter Source Process ID: parameter Target Handle ID: parameter Target Process ID: parameter

Explanation:

This event record indicates that a handle has been duplicated for the same or less access than previously granted. This audit event is only generated if the handle being duplicated caused an audit event record to be displayed when created. If the duplication is for more access than the source handle has been granted, the duplication is treated as an object open and an Object Open audit record is generated instead of a Duplicate Handle audit record. If the source handle is closed, a separate Handle Closed audit record is generated. Windows 2000 does not support duplication of protected server objects. Note: Handle Duplication audit records always refer to kernel objects.