Windows process creation auditing

Published on Sep 2, 2026

1 minute(s) read

Article summary

Trellix highly recommends tracking process creation activity, which is not enabled by default. Windows 7, Server 2008 and later operating systems support process creation auditing, and Server 2012 has auditing of command line activity. For more information, see:

http://technet.microsoft.com/en-us/library/dd941613(v=ws.10).aspx
http://technet.microsoft.com/en-us/library/dn535776.aspx

Was this article helpful?