Event ID: 592
A new process has been createdA new process has been created:
New Process ID: %1
Image File Name: %2
Creator Process ID: %3
User Name: %4
Domain: %5
Logon ID: %6
Token Elevation Type: %7| Fields | Definition | Insertion String |
|---|---|---|
| New Process ID | Unique Process ID | %1 |
| Image File Name | Path to executable | %2 |
| Creator Process ID | Parent Process ID | %3 |
- Event ID 593 with the same Process ID will be logged when the process ends.
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /category:"Detailed Tracking"
Audit Category:
Detailed TrackingLEFT/RIGHT arrow keys for navigation
Back to List