A process has exited
On this page
The program identified in Image File Name was closed or terminated. To find out when the program started, look for the preceding 592 with the same Process ID.
In Windows 2000 there is no image file Name field. So to determine the name of the program you must find the preceding event 592.
To identify the program on Windows Server 2003 you can simply use the image name which is supplied in this event.
Free Security Log Quick Reference Chart
Top 10 Windows Security Events to Monitor
Process has exited:
Windows Server 2003 inserts the following field:
Image File Name:C:\WINDOWS\system32\notepad.exe
All versions log the following fields:
Keep me up-to-date on the Windows Security Log.
*We will NOT share this
Go To Event ID: