Unable to View Process Command Line for Event 4688 in Windows Server

Question

There is an issue viewing the process command line in Process Information in Event Properties for Event 4688 in Windows Server, even after enabling the following settings in the local group policy:

1. Computer Configuration > Policies > Administrative Templates > System > Audit Process Creation.
2. Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Detailed Tracking > Audit Process Creation.

What additional settings or services need to be enabled to see the process command line in Process Information for Event 4688 in Windows Server?

Answer 1

Hello Sridhar Anbazhagan,

Thank you for posting in Q&A forum.

I think the settings you mentioned are correct. Because it is computer configuration, you should link the GPO with settings above to an OU with domain computer objects, not the domain user objects.
And this event generates every time a new process starts.

I hope the information above is helpful.

If you have any questions or concerns, please feel free to let us know.

Best Regards,

Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.