Event ID 592

A new process has been created 

A new process has been created:
    New Process ID:         %1
    Image File Name:        %2
    Creator Process ID:     %3
    User Name:              %4
    Domain:                 %5
    Logon ID:               %6
    Token Elevation Type:   %7


Fields Definition Insertion String
New Process ID Unique Process ID %1
Image File Name Path to executable %2
Creator Process ID Parent Process ID %3
  • Event ID 593 with the same Process ID will be logged when the process ends.


Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /category:"Detailed Tracking"
How to enable Windows Auditing
Recommended Audit Policy

Operating Systems:
Windows Server 2000 Windows 2003 Windows XP

Audit Category:
Detailed Tracking

LEFT/RIGHT arrow keys for navigation

Back to List