Event ID: 592

A new process has been created

A new process has been created:
    New Process ID:         %1
    Image File Name:        %2
    Creator Process ID:     %3
    User Name:              %4
    Domain:                 %5
    Logon ID:               %6
    Token Elevation Type:   %7

Fields Definition Insertion String
New Process ID Unique Process ID %1
Image File Name Path to executable %2
Creator Process ID Parent Process ID %3
  • Event ID 593 with the same Process ID will be logged when the process ends.

Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /category:"Detailed Tracking"

Audit Category:
Detailed Tracking

LEFT/RIGHT arrow keys for navigation

Back to List