Submit a ticketCall us

Training ClassThe Orion® Platform Instructor-led Classes

Provided by SolarWinds® Academy, these trainings will introduce users to the Orion Platform and its features, management, and navigation. These courses are suitable for users looking to discover new tips, tricks, and ways to adapt their Orion products to better suit their monitoring needs:
Deploying the Orion Platform
Configuring Orion views, maps, and accounts
Configuring Orion alerts and reports

Reserve your seat.

Home > Success Center > Log & Event Manager (LEM) > LEM - Knowledgebase Articles > FIM Related Windows Events for LEM

FIM Related Windows Events for LEM

Table of contents
Created by Craig O’ Neill, last modified by Justin Rouviere on Jan 11, 2017

Views: 1,212 Votes: 1 Revisions: 4

Updated: July 5, 2016


This article provides information about Windows events similar to FIM connector events logged as it watches certain events on the client machine.


  • LEM version 6.0 and later
  • Windows


Here are the Windows Events which are used for File Integrity Monitoring:

  • 4656 A handle to an object was requested
  • 4657 A registry value was modified
  • 4658 The handle to an object was closed
  • 4659 A handle to an object was requested with intent to delete
  • 4660 An object was deleted
  • 4661 A handle to an object was requested
  • 4662 An operation was performed on an object
  • 4663 An attempt was made to access an object




Last modified