Event ID 593
A process has exitedA process has exited:
Process ID: %1
Image File Name: %2
User Name: %3
Domain: %4
Logon ID: %5
Exit Status: %6| Fields | Definition | Insertion String |
|---|---|---|
| New Process ID | Unique Process ID | %1 |
| Image File Name | Path to executable | %2 |
| User Name | User who terminated the process | %3 |
| Domain | Domain of user who terminated the process | %4 |
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /category:"Detailed Tracking"
Audit Category:
Detailed TrackingLEFT/RIGHT arrow keys for navigation
Back to List