Event ID: 600

A process was assigned a primary token

A process was assigned a primary token.
 Assigning Process Information:
    Process ID:        %1
    Image File Name:   %2
    Primary User Name: %3
    Primary Domain:    %4
    Primary Logon ID:  %5

 New Process Information:
    Process ID:        %6
    Image File Name:   %7
    Target User Name:  %8
    Target Domain:     %9
    Target Logon ID:   %10


Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /category:"Detailed Tracking"
How to enable Windows Auditing


Audit Category:
Detailed Tracking
Corresponding Events:
4696


LEFT/RIGHT arrow keys for navigation

Back to List