Windows 10: Event ID 4688 not showing anything, but 4696 does

Hi,I have turned on Local Security Policy: Advanced Audit Policy Configuration > System Audit Policies > Detailed Tracking > Audit Process Creation = Success. And according to this : https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-process-creation I should get both event 4688 and event 4696. But I only get logs for 4696. And they don't show all of the programs that were started. Also I implemented MS Security Baseline for Win 11 22H2 from here: https://www.microsoft.com/en-us/download/details.aspx?id=55319What else do I have to enable to get e

:)

 

Event ID 4688 not showing anything, but 4696 does

Hi,

I have turned on Local Security Policy: Advanced Audit Policy Configuration > System Audit Policies > Detailed Tracking > Audit Process Creation = Success.

And according to this :

Audit Process Creation (Windows 10) - Windows security I should get both event 4688 and event 4696. But I only get logs for 4696. And they don't show all of the programs that were started.

Also I implemented MS Security Baseline for Win 11 22H2 from here:

https://www.microsoft.com/en-us/download/details.aspx?id=55319

What else do I have to enable to get event 4688 ?

 

Event viewer - Event id 4688

I tried to create a custom view, with Windows Logs as the event log, and 4688 as the event ID. I had no other changed settings, and I expected this to give me a stream of events showing whenever I opened an application. Instead I only got events related
to Microsoft processes.

I want to have this because I want to run a program whenever a specific program runs.

I wonder if there is a problem with how I created the custom view, or if there is a different way to see when a program

Edit : As per Igor Leyko's reply, I have tried to enable process auditing. I have done so in :

Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy\Audit process tracking

Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\System Audit Policies - Local Group Policy Object\Detailed Tracking\Audit Process Creation

But still it doesn't work, maybe I missed a setting, I'm not sure.

 

Event viewer - Event id 4688

Hi,

you need to turn audit to view this event. See recommendations at
https://docs.microsoft.com/en-us/windows/securi...