Windows Security Log Event ID 593

Operating Systems Windows Server 2000
Windows 2003 and XP
CategoryProcess Tracking
Type Success
Corresponding events
in Windows 2008
and Vista

593: A process has exited

On this page

The program identified in Image File Name was closed or terminated. To find out when the program started, look for the preceding 592 with the same Process ID.

In Windows 2000 there is no image file Name field. So to determine the name of the program you must find the preceding event 592.

To identify the program on Windows Server 2003 you can simply use the image name which is supplied in this event.

Free Security Log Resources by Randy

Description Fields in 593

  • Process ID:
  • Image File Name: (Windows Server 2003 only)
  • User Name:
  • Domain:
  • Logon ID:

Setup PowerShell Audit Log Forwarding in 4 Minutes


Examples of 593

Process has exited:
Process ID:2084
Windows Server 2003 inserts the following field:
Image File Name:C:\WINDOWS\system32\notepad.exe
All versions log the following fields:
User Name:administrator
Logon ID:(0x0,0x158EB7)

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection


Upcoming Webinars
    Additional Resources