How are object access events generated?

I wrote this as an answer for Tom, who emailed me, but I thought I’d share it with everyone.   There are 7 events associated with object access auditing in Windows:   560 is the “open handle” event.  It is logged when an app asks for access to an object (via a call like CreateFile).  An…

6