Fix: Event ID 4663, An Attempt Was Made to Access An Object

Remove unfamiliar event logs from the system for a quick fix

4 min. read

Updated onOctober 18, 2023

updated onOctober 18, 2023

Share this article

Improve this guide

Read our disclosure page to find out how can you help Windows Report sustain the editorial teamRead more

Key notes

Event 4663 may indicate that a user has logged on to a domain computer using an account that is not authorized to be used to log on to the domain. This can occur if theaccount was disabled or removedfrom the Domain Admins group.

If you see this error regularly, it could be related to permissions on shared folders or drives and/or improperly configured user accounts with insufficient access rights. Still, it’s worth checking out because if left unattended, the user may gain access.

What is Event ID 4663?

Event ID 4663 is logged when a particular operation is performed on an object. This event can be viewed in the Security log and has a target of the security log. The Event ID 4663 will be recorded in the security log when a user attempts to perform an operation that requires administrator permissions.

The main categories of object types are as follows:

An attempt was made to access an object could mean:

How can I fix Event ID 4663?

First off, ensure you check the following:

1. Check and remove Event logs

The Event ID 4663 attempt may be due to an internal or external security breach, and a user account is being used by malicious software to access the system. This account may have been created by malware or by an attacker exploiting a vulnerability in network services.

2. Disable remote access

A Windows server can be accessed remotely if it is running a service. For example, if you want to access your server via Remote Desktop, you need to enable this feature.

Disabling remote access should be a temporary security measure until you determine whether the Event ID 4663 is a brute-force attack.

That’s all we had for this Event ID, but check out what we have in store. For instance, the Event ID 4648, where a logon using credentials was attempted, orEvent 4502that is related to WinREAgent.

Share any additional thoughts on this topic in the comment section below.

Fix: Event ID 4663, An Attempt Was Made to Access An Object#

How can I fix Event ID 4663?#

1. Check and remove Event logs#

2. Disable remote access#

Fix: Event ID 4663, An Attempt Was Made to Access An Object

How can I fix Event ID 4663?

1. Check and remove Event logs

2. Disable remote access