Event Details
User Activity->Permission Changes->File System Permission Changes->Windows 2008->EventID 4670 - Permissions on an object were changed.
EventID 4670 - Permissions on an object were changed.
 Sample: 
Log Name:      Security
Source:          Microsoft-Windows-Security-Auditing
Date:             9/23/2010 4:10:19 PM
Event ID:      4670
Task Category: Subcategory could not be determined
Level:            Information
Keywords:     Audit Success
User:             N/A
Computer:     DC1
Description:
Permissions on an object were changed.

Subject:
	Security ID:		RESEARCH\ALebovsky
	Account Name:	ALebovsky
	Account Domain:	RESEARCH
	Logon ID:		0x24662e

Object:
	Object Server:	Security
	Object Type:	                     File
	Object Name:	C:\Temp\sec2008_Security-Auditing.xml
	Handle ID:	0x938

Process:
	Process ID:	0x844
	Process Name:	C:\Windows\explorer.exe

Permissions Change:
	Original Security Descriptor:	D:AI(A;;0x1200a9;;;S-1-5-21-1605701383-399426181-3496453892-1116)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)
	New Security Descriptor:	D:ARAI(A;;0x1301bf;;;S-1-5-21-1605701383-399426181-3496453892-1116)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)
Log Type: Windows Event Log
 Uniquely Identified By:
Log Name: Security
Filtering Field Equals to Value
OSVersion Windows Vista (2008)
Windows 7 (2008 R2)
Windows 8 (2012)
Windows 8.1 (2012 R2)
Windows 10 (2016)
Category Policy Change
Source Microsoft-Windows-Security-Auditing
EventId 4670
InsertionString6 File
Field Matching
FieldDescriptionStored inSample Value
When At what date and time a user activity originated in the system. DateTime 10.10.2000 19:00:00
Who Account or user name under which the activity occured. Subject: Account Name ALebovsky
What The type of activity occurred (e.g. Logon, Password Changed, etc.) "Permission Change" Permission Change
Where The name of the workstation/server where the activity was logged. Computer DC1
Where From The name of the workstation/server where the activity was initiated from. - 10.10.10.10
Severity Specify the seriousness of the event. "High" High
WhoDomain Subject: Account Domain
WhereDomain -
Object Type The type of object whose permissions were changed (e.g. AD object, file, registry, etc.) Object Type File or Folder
Object Name The name of the object whose permissions were changed (e.g. full system path to the file or folder) Object Name
To Whom Account whose access permissions to the object were changed -
Comments
You must be logged in to comment