What does Event 4663 mean?

In the context of Spirion Sensitive Data Platform, this is the "smoking gun" for troubleshooting Access Denied errors. It tells you exactly which process (Spirion) tried to do what (Read, Write, Delete) to which file, and whether the operating system allowed it.

How to Read Event 4663 for Spirion

When you open the event details, look for these specific fields to understand why a scan or remediation failed:

1. Subject (Who did it?)

• Security ID: This should be your Spirion Service Account. If it says SYSTEM, the Agent is running as the local system account.
• Account Name: The specific username Spirion is using to perform the scan.

2. Process Information (What tool was used?)

• Process Name: This should be the path to the Spirion executable (e.g., C:\Program Files\Spirion\Agent\bin\spirion.exe).
• • Note: If you see a different process name here (like MsMpEng.exe), it means the Antivirus is the one touching the file, not Spirion.

3. Object (What was targeted?)

• Object Name: The full file path or UNC path (for example, \\Server\Share\Documents\SensitiveData.xlsx) that Spirion was trying to access.

4. Access Request Information (What was the goal?)

This is the most important part for troubleshooting.

It uses "Access Masks" to show what Spirion was trying to do:

• READ_CONTROL or ReadData (0x1): Spirion was trying to scan the file. If this failed, the scan will show "Access Denied."
• WriteAttributes (0x100): Spirion was trying to apply an NTFS Classification tag. If this failed, the file was scanned but not labeled.
• DELETE (0x10000): Spirion was trying to Shred or Quarantine (Move) the file.

Why am I seeing this event?

You see Event 4663 only if Object Access Auditing is enabled in your Windows Group Policy (GPO).

• If it's a "Success Audit": It means Spirion successfully accessed the file. This is useful for proving that the agent can reach the data.
• If it's a "Failure Audit": This is the confirmation of an Access Denied error. It means the NTFS permissions or a security policy blocked the Spirion Service Account from that specific file.

Troubleshooting Tip

If you see a Failure Audit for Event 4663:

1. Check the Access Mask.
2. If the mask is 0x100 (Write Attributes), go to the folder's Security > Advanced settings and ensure the Spirion Service Account has the "Write attributes" permission checked.
3. If the mask is 0x1 (Read Data), ensure the account has "Read" permissions.

Summary

Event 4663 is the detailed record of a file access attempt. It identifies the Service Account, the File Path, and the Action (Read/Write/Delete) that was attempted.