Windows Security Log Event ID 593

593: A process has exited

On this page

• Description of this event
• Field level details
• Examples
• Mini-seminars on this event

The program identified in Image File Name was closed or terminated. To find out when the program started, look for the preceding 592 with the same Process ID.

In Windows 2000 there is no image file Name field. So to determine the name of the program you must find the preceding event 592.

To identify the program on Windows Server 2003 you can simply use the image name which is supplied in this event.

Free Security Log Resources by Randy

• Free Security Log Quick Reference Chart
• Windows Event Collection: Supercharger Free Edtion
• Free Active Directory Change Auditing Solution
• Free Course: Security Log Secrets

Description Fields in 593

• Process ID:
• Image File Name: (Windows Server 2003 only)
• User Name:
• Domain:
• Logon ID:

Supercharger Free Edition

 

Mini-Seminars Covering Event ID 593 Insider Gone Bad: Tracking Their Steps and Building Your Case with the Security Log

 

Upcoming Webinars Assessing the Security of Your Active Directory: User Accounts Anatomy of a Cloud Hack: The Cloudflare/Okta Compromise – A Story of Tokens, Lateral Movement, Persistence and the Salvation of Zero Trust and Hard MFA Tokens

Additional Resources

•	Event IDs
•	All Event IDs
•	Audit Policy