Event ID: 593

A process has exited

A process has exited:
    Process ID:       %1 
    Image File Name:  %2 
    User Name:        %3
    Domain:           %4
    Logon ID:         %5
    Exit Status:      %6

Fields Definition Insertion String
New Process ID Unique Process ID %1
Image File Name Path to executable %2
User Name User who terminated the process %3
Domain Domain of user who terminated the process %4


Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /category:"Detailed Tracking"
How to enable Windows Auditing


Audit Category:
Detailed Tracking

LEFT/RIGHT arrow keys for navigation

Back to List