How to audit process tracking

Start your free trial

An IT administrator in any organization is responsible for tracking user activity and ensuring there are no insider threats. To carry out these responsibilities, they must monitor what applications or software an employee accesses on their workstation; if this isn't tracked, an employee could intentionally or unintentionally run any sort of malware, leading not only to device compromise, but also potentially put the entire enterprise network in danger. In an Active Directory (AD) environment, this tracking is referred to as auditing process tracking. Read on to find out how to audit process tracking.

Windows Native Auditing
ADAudit Plus

Steps to enable auditing using the Group Policy Management Console (GPMC):

Perform the following actions on the domain controller (DC):

Press Start, search for, and open the Group Policy Management Console or run the command gpmc.msc.

Right-click the domain or organizational unit (OU) that you want to audit, and click Create a GPO in this domain, and Link it here. If you have already created a Group Policy Object (GPO), go to step 4.

How to detect who unlocked a user account

Name the GPO as appropriate.
Right-click the GPO and choose Edit.

In the Group Policy Management Editor, in the left pane, navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Audit Policies → Detailed Tracking.

In the right pane, you will see a list of policies that are under Detailed Tracking. Double-click Audit Process Creation and check the boxes labeled Configure the following audit events, Success, and Failure. Perform the same actions for Audit Process Termination.

Click Apply, then OK.
Go back to the Group Policy Management Console, and in the left pane, right-click the desired OU in which the GPO was linked and click Group Policy Update. This step makes sure the new Group Policy settings are applied instantly instead of waiting for the next scheduled refresh.

Once this policy is enabled, events are logged in the DC's security log whenever a process has been created or has exited.

Steps to view these events using the Event Viewer:

Once the above steps are complete, events will be stored in the event log. This can be viewed in the Event Viewer by following the steps below:

Press Start, search for Event Viewer, and click to open it.
In the Event Viewer window, in the left pane, navigate to Windows Logs → Security.
Here, you will find a list of all the security events that are logged in the system.

In the right pane, under Security, click Filter Current Log.

In the pop-up window, enter the desired Event ID* in the field labeled <All Event IDs>.

*The following Event IDs are generated for the given events:

Event ID	Subcategory	Event Type	Description
4688	Audit Process Creation	Success	A new process has been created.
4696	Audit Process Creation	Success	A primary token was assigned to process.
4689	Audit Process Termination	Success	A process has exited.

Click OK. This will provide a list of occurrences of the entered Event ID.
Double-click the Event ID to view its properties (description).

Event 4688 is logged when a process is created. The following details are logged in the event properties:

Name and SID of the account that requested the "create process" operation
Process ID, full path, and name of the new process created

The above method is unrealistic when you have to deal with thousands of devices in an organization, as an administrator would have to manually look up each event to view its details.

ADAudit Plus, a comprehensive AD auditing tool, enables admins to effortlessly audit process creation and termination events. They can also keep track of all scheduled task creation, deletion, and modifications made to them with ease.

Download 30-day, free trial

Steps to audit process tracking using ManageEngine ADAudit Plus

Download and install ADAudit Plus.
Find the steps to configure auditing on your domain controller here.
Open the console and log in as administrator.
Navigate to Server Audit → Process Tracking → New Process Created

You can also keep track of process termination. Navigate to Server Audit → Process Tracking → New Process Exited.

Advantages of using ADAudit Plus over native auditing:

Get instant, informative reports on process creation and termination instead of manually searching for an Event ID.
Monitor all programs that are executed, and discover who started the process, which computer the program was launched on, the time the process was started, and much more.
Track in detail all scheduled tasks set by users in your organization.
Get curated reports for all changes made to your Active Directory in one centralized platform.
More easily satisfy compliance regulations including SOX, HIPAA, GLBA, PCI-DSS, FISMA, and GDPR.

Download 30-day, free trial

Don't wait for your annual compliance audit.

Use over 300 prebuilt AD audit reports
Track user logon history
Monitor file integrity

Starting today

Thank you for your interest in ADAudit Plus!

Our team will be in touch with you shortly.

Active Directory auditing

Windows file auditing

NAS device file auditing

Windows server auditing

Workstation auditing

Entra ID auditing

All features →

Help documents

Video zone

Webinars

Product brochures

Case studies

E-books

Awards zone

Study

How tos

Best practices

How to audit process tracking

Steps to enable auditing using the Group Policy Management Console (GPMC):

Steps to view these events using the Event Viewer:

*The following Event IDs are generated for the given events:

Steps to audit process tracking using ManageEngine ADAudit Plus

Don't wait for your annual compliance audit.

Thank you for your interest in ADAudit Plus!

Related How to

Secure your ADstarting today

Thank you for your interest in ADAudit Plus!

ADAudit Plus Trusted By

Meet all auditing and IT security needs with ADAudit Plus.

A single pane of glass for complete Active Directory Auditing and Reporting

Identity and access management

Unified service management

Unified endpoint management and security

IT operations management and observability

Security information and event management

Advanced IT analytics

Low-code app development

Cloud solutions for enterprise IT

IT management for MSPs

Active Directory management Manage, track, and secure Active Directory

Identity governance and administrationOrchestrate user identity management and access controls for Zero Trust

Privileged access managementControl and secure privileged access to critical enterprise systems

Enterprise and IT service managementDeliver a consistent employee experience across business functions

Customer service managementBuild a one-stop portal for customers with efficient account management

IT asset managementCentralize and automate the complete IT asset life cycle

SIEM Spot, investigate, and neutralize security threats

Log and compliance managementGain deeper visibility into security events and ensure compliance

Security auditingAudit Active Directory, cloud platforms and files to enhance your security posture

Endpoint management and protection platform (UEM and EPP)Secure and manage endpoints to protect your IT assets effectively

Endpoint managementAchieve intelligent IT device management with zero user intervention

Endpoint securityDefend against threat actors with proactive and reactive measures

Full-stack observability and digital experience monitoringAchieve end-to-end visibility, proactive issue resolution, and enhanced security

Network and server performance monitoringEnsure network, server, and storage reliability with AI-powered insights

IT incident managementEfficiently manage and resolve IT incidents while ensuring transparency

DNS and DHCP managementOptimize IP address and domain management

Cloud cost managementRight-size and take control of your cloud costs

IT analyticsConnect to your IT applications and visualize all facets of your IT

Cloud-native solutions for IT managementMonitor, manage, audit, and secure your multi-cloudand hybrid infrastructure

Business applications for ITBoost productivity and improve team collaboration

Custom solution builderBuild tailor-made apps to automate operations at your organization

Solutions for MSPsGrow your MSP business with scalable and secure IT management solutions

How to audit process tracking

Steps to enable auditing using the Group Policy Management Console (GPMC):

Steps to view these events using the Event Viewer:

*The following Event IDs are generated for the given events:

Steps to audit process tracking using ManageEngine ADAudit Plus

Don't wait for your annual compliance audit.

Thank you for your interest in ADAudit Plus!

Related How to

Secure your ADstarting today

Thank you for your interest in ADAudit Plus!

ADAudit Plus Trusted By

Meet all auditing and IT security needs with ADAudit Plus.

A single pane of glass for complete Active Directory Auditing and Reporting

Active Directory
management Manage, track, and secure Active Directory

Identity governance
and administrationOrchestrate user identity management and access controls for Zero Trust

Privileged access
managementControl and secure privileged access to critical enterprise systems

Enterprise and IT service
managementDeliver a consistent employee experience across business functions

Customer service
managementBuild a one-stop portal for customers with efficient account management

IT asset
managementCentralize and automate the complete IT asset life cycle

Network and server
performance monitoringEnsure network, server, and storage reliability with AI-powered insights

IT incident
managementEfficiently manage and resolve IT incidents while ensuring transparency

Cloud-native solutions for IT managementMonitor, manage, audit, and secure your multi-cloud
and hybrid infrastructure