WinSecWiki > Security Settings > Local Policies > Audit Policy > Process Tracking > Process Termination

Process Termination

This category is logged on all types of computers and allows you to track the completion of every program that executes on the local computer. To configure this on Server 2008 and Vista you must use auditpol. Windows 7 and Server 2008 R2 and later can use Group Policy.

Coverage on events generated by this category are currently in the Security Log Encyclopedia:

Event ID	Title
4689	A process has exited

Back to top

 

Upcoming Webinars Anatomy of a Cloud Hack: The Cloudflare/Okta Compromise – A Story of Tokens, Lateral Movement, Persistence and the Salvation of Zero Trust and Hard MFA Tokens

Additional Resources