Direct Inward Dialing: +1 408 916 9892
Audit Process Creation is an advanced Audit Policy setting which, when enabled, can help track the processes that are created or started on the system. Once this setting is enabled, the Windows Event Viewer will generate an event every time a process starts.
Regularly auditing the processes on your network helps detect any malicious processes that might be running on your system. For example, a user might inadvertently download a malware, that in turn creates several processes. If Audit Process Creation is enabled, it should enable you to detect these processes. Once they are detected, you can take remedial action.
Once Audit Process Creation is enabled, it will record the following event IDs:
ADAudit Plus is an Active Directory auditing tool that can track and report on various network entities, such as users, servers, workstations and so on. It also has a separate section on server audit, where there are reports on user logons, file integrity monitoring and process tracking. These reports can help an admin keep the servers on the network secure. Here is a sample report from ADAudit Plus on Audit Process Creation:
This report gives information on the name of the process, the system where the process runs, the time stamp, the user who created the process and so on. Regularly checking this report can ensure that only legitimate processes are running on the server and any suspicious process can be immediately detected. This report can be accessed by navigating to Server Audit > Process Tracking > New Process Created.
Try ADAudit Plus login monitoring tool to audit, track, and respond to malicious login and logoff actions instantaneously.
Try ADAudit Plus for free
Free Edition
