Windows Security Log Events by ID

look up more events by Event ID or Category

Event ID	593
Title	A process has exited
Type:	Example:	Randy's Comments:
Success OS: All versions Category: Detailed Tracking	A process has exited: Process ID:2084 Windows Server 2003 inserts the following field: Image File Name:C:\WINDOWS\system32\notepad.exe All versions log the following fields: User Name:administrator Domain:ELM Logon ID:(0x0,0x158EB7)	The program identified in Image File Name was closed or terminated. To find out when the program started, look for the preceding 592 with the same Process ID. In Windows 2000 there is no image file Name field. So to determine the name of the program you must find the preceding event 592. To identify the program on Windows Server 2003 you can simply use the image name which is supplied in this event. Next: Top 10 Most Important Events to Monitor

Upcoming Webinars by Randy Franklin Smith

A
D
V