DetailedTracking_AuditProcessCreation

DetailedTracking_AuditProcessCreation

Description

This policy setting allows you to audit events generated when a process is created or starts. The name of the application or user that created the process is also audited.

Audit Policy CSP - Windows Client ManagementMicrosoftLearn

CSP

./Device/Vendor/MSFT/Policy/Config/Audit/DetailedTracking_AuditProcessCreation

Recommended Setting

Format: int Value: 1

Audit event on success.

Available in Settings Catalog

YES

Audit Process Creation