---
title: "What does Event 4663 mean?"
url: "https://dm0bkdes5q7a2ls.productfruits.help/en/article/what-does-event-4663-mean"
language: "en"
last_updated: "2026-05-29T01:54:26.652Z"
---

# What does Event 4663 mean?

Event ID 4663 is a Windows Security log event that indicates "An attempt was made to access an object."

In the context of Spirion Sensitive Data Platform, this is the "smoking gun" for troubleshooting **Access Denied** errors. It tells you exactly which process (Spirion) tried to do what (Read, Write, Delete) to which file, and whether the operating system allowed it.

## How to Read Event 4663 for Spirion

When you open the event details, look for these specific fields to understand why a scan or remediation failed:

#### **1\. Subject (Who did it?)**

-   **Security ID:** This should be your **Spirion Service Account**. If it says `SYSTEM`, the Agent is running as the local system account.
-   **Account Name:** The specific username Spirion is using to perform the scan.

#### **2\. Process Information (What tool was used?)**

-   **Process Name:** This should be the path to the Spirion executable (e.g., `C:\Program Files\Spirion\Agent\bin\spirion.exe`).
-   -   **Note**: If you see a different process name here (like `MsMpEng.exe`), it means the Antivirus is the one touching the file, not Spirion.

#### **3\. Object (What was targeted?)**

-   **Object Name:** The full file path or UNC path (for example, `\\Server\Share\Documents\SensitiveData.xlsx`) that Spirion was trying to access.

#### **4\. Access Request Information (What was the goal?)**

This is the most important part for troubleshooting.

It uses "Access Masks" to show what Spirion was trying to do:

-   `READ_CONTROL` or `ReadData` (0x1): Spirion was trying to scan the file. If this failed, the scan will show "Access Denied."
-   `WriteAttributes` (0x100): Spirion was trying to apply an **NTFS Classification** tag. If this failed, the file was scanned but not labeled.
-   `DELETE` (0x10000): Spirion was trying to **Shred** or **Quarantine** (Move) the file.

* * *

## Why am I seeing this event?

You see Event 4663 only if **Object Access Auditing** is enabled in your Windows Group Policy (GPO).

-   **If it's a "Success Audit":** It means Spirion successfully accessed the file. This is useful for proving that the agent *can* reach the data.
-   **If it's a "Failure Audit":** This is the confirmation of an **Access Denied** error. It means the NTFS permissions or a security policy blocked the Spirion Service Account from that specific file.

## Troubleshooting Tip

If you see a **Failure Audit** for Event 4663:

1.  Check the **Access Mask**.
2.  If the mask is `0x100` (Write Attributes), go to the folder's **Security > Advanced** settings and ensure the Spirion Service Account has the **"Write attributes"** permission checked.
3.  If the mask is `0x1` (Read Data), ensure the account has **"Read"** permissions.

## Summary

Event 4663 is the detailed record of a file access attempt. It identifies the **Service Account**, the **File Path**, and the **Action** (Read/Write/Delete) that was attempted.