Blog

Event ID 4660 errors on Windows 11 can be confusing and concerning for many users. These errors typically indicate that a file or registry key was deleted, which can sometimes be part of normal system activity or a sign of an issue. Understanding how to fix these errors is important to maintain system health and security.

This guide will walk you through simple steps to troubleshoot and resolve Event ID 4660 errors. Each step is explained clearly, so even beginners can follow along without worry.

By following these instructions carefully, you can identify the root cause and fix the problem efficiently. Let’s get started and make your Windows 11 system error-free.

Before diving into the fixes, it’s helpful to know a few quick checks that can save you time.

Quick Note: Prerequisites and Initial Checks

• Check for recent changes: Identify if you recently installed new software, updates, or changed system settings. These can trigger Event ID 4660 errors.
• Have administrator access: Many troubleshooting steps require admin rights. Make sure you are logged in as an administrator.
• Backup important data: Before making major changes, back up your files to avoid accidental loss.
• Update Windows 11: Keeping your system updated often fixes bugs and security issues. Go to Settings > Windows Update and install all pending updates.

Step 1: Understand What Event ID 4660 Means

Event ID 4660 is logged in the Security Event Log when a file or registry key is deleted. This event comes from the Windows auditing system, which tracks important security information. Knowing this helps you understand whether the deletion was expected or a potential problem.

Sometimes, legitimate software or Windows components delete files, so seeing this event occasionally is normal. However, frequent or unexpected deletions might indicate malware, permission issues, or system corruption.

Step 2: Review the Event Details Carefully

Open the Event Viewer to analyze the error. Here’s how:

1. Press Win + S and type Event Viewer, then press Enter.
2. In the left pane, expand Windows Logs and select Security.
3. Look for Event ID 4660 entries in the middle pane.
4. Click an event to see detailed information in the bottom pane, such as which object was deleted and which user or process performed the deletion.

This data is critical to understand whether the deletion is part of expected activity or something to investigate further.

Step 3: Scan for Malware and Viruses

Malicious software can delete important files and cause Event ID 4660 errors. Running a full system scan helps eliminate this possibility.

• Open Windows Security by pressing Win + I and navigating to Privacy & Security > Windows Security.
• Select Virus & threat protection and click Quick scan. For a deeper check, choose Scan options and select Full scan.
• If threats are found, follow the prompts to remove or quarantine them.

This step ensures that your system is clean and the deletions are not caused by harmful programs.

Step 4: Check File and Folder Permissions

Incorrect permissions can cause files or registry keys to be deleted unexpectedly or trigger auditing errors. Fixing permissions might resolve the problem.

1. Right-click the folder or file mentioned in the Event 4660 details and select Properties.
2. Go to the Security tab and click Edit to adjust permissions.
3. Ensure that your user account and essential system accounts (like SYSTEM) have appropriate permissions.
4. Click Advanced to see more detailed permissions and ownership. If ownership is incorrect, click Change and assign it to your user or the SYSTEM account.

Proper permissions prevent unauthorized or accidental deletion and help audit logs reflect accurate information.

Step 5: Use System File Checker (SFC) and DISM Tools

Corrupted system files can cause unexpected errors. Running built-in repair tools helps restore system integrity.

1. Open Command Prompt as administrator: Press Win + S, type cmd, right-click Command Prompt, and choose Run as administrator.
2. Type the following command and press Enter:
   sfc /scannow
3. Wait for the scan to complete. It will automatically fix corrupted files if found.
4. If problems persist, run the Deployment Image Servicing and Management tool by typing:
   DISM /Online /Cleanup-Image /RestoreHealth
5. After DISM finishes, run sfc /scannow again to verify repairs.

These tools repair damaged system files that might cause Event ID 4660 errors.

Step 6: Disable Auditing for File Deletion (Optional Advanced Step)

If Event ID 4660 is benign but floods your logs, you may want to limit auditing to reduce noise.

1. Press Win + R, type secpol.msc, and press Enter to open Local Security Policy.
2. Navigate to Advanced Audit Policy Configuration > Object Access.
3. Find Audit File System and Audit Registry.
4. Double-click each and uncheck Success or Failure as needed to reduce which events are logged.
5. Click OK and restart your computer.

Note: Disabling auditing reduces visibility into deletions and may affect security monitoring. Use this only if you understand the risks.

FAQs About Event ID 4660 Errors on Windows 11

Q: Is Event ID 4660 always a sign of a problem?

A: No. It simply logs that an object was deleted. Sometimes this is normal system or software activity.

Q: Can malware cause Event ID 4660 errors?

A: Yes. Malicious programs may delete files or keys, triggering these events. Running a full malware scan is important.

Q: Will disabling auditing stop the errors?

A: Disabling auditing stops the events from being logged but does not fix the underlying cause of deletions.

Q: Can I ignore occasional Event ID 4660 events?

A: Usually yes, if they don’t happen frequently and no system issues are noticed.

Q: How do I know which process deleted a file?

A: The Event Viewer details often include the user or process responsible. For deeper tracking, third-party monitoring tools can help.

When Nothing Works: Final Steps and Resources

If you have tried all the above steps and still face frequent Event ID 4660 errors, consider the following:

• Restore from a System Restore Point: If the problem started recently, restoring your system to an earlier state can help.
• Perform a Clean Boot: This starts Windows with minimal drivers and startup programs to isolate third-party software conflicts.
• Contact Microsoft Support: Visit the official Microsoft support website for more in-depth assistance and troubleshooting.
• Use the Microsoft Community Forums: Many users share solutions for specific errors, including Event ID 4660.

Conclusion

Event ID 4660 errors are a security audit log for deleted files and registry keys. While sometimes harmless, frequent or unexpected occurrences deserve attention. This guide provided clear, step-by-step instructions starting from basic checks to advanced troubleshooting.

Always begin by reviewing the event details, scanning for malware, and verifying permissions. Use system repair tools if needed, and consider disabling auditing only if the logs become too noisy. If all else fails, restore your system or seek professional support.

By following these steps carefully, you can maintain a healthy, secure Windows 11 system and minimize Event ID 4660 errors effectively.