Event-o-Pedia EventID 592 - A new process has been created

	Event Details
	User Activity->Programs Execution->Windows 2000-2003->EventID 592 - A new process has been created

EventID 592 - A new process has been created

Linked Event:

EventID 592 - A new process has been created

Sample:

Event Type:     SuccessAudit
Event Source:   Security
Event Category: Detailed Tracking
Event ID:       592
Date:           10/26/2009 12:00:00 AM
Time:           07:31:43
User:           RESEARCH\ALebovsky
Computer:       DC1
Description:    
A new process has been created:

	New Process ID:	2244

	Image File Name:	C:\Generate_Security_Events1\unied.exe

	Creator Process ID:	528

	User Name:	Alebovsky

	Domain:		RESEARCH

	Logon ID:		(0x0,0x59DF36)

Log Type:

Windows Event Log

Uniquely Identified By:

Log Name:

Security

Filtering Field	Equals to Value
OSVersion	Windows 2000 Windows XP Windows 2003
Category	Detailed Tracking
Source	Security
EventId	592

Field Matching

Field	Description	Stored in	Sample Value
When	At what date and time a user activity originated in the system.	DateTime	12/14/2009 6:59:09 AM
Who	Account or user name under which the activity occured.	User Name	Alebovsky
What	The type of activity occurred (e.g. Logon, Password Changed, etc.)	"Process Created"	Process Created
Where	The name of the workstation/server where the activity was logged.	Computer	DC1
Where From	The name of the workstation/server where the activity was initiated from.	-	10.10.10.10
Severity	Specify the seriousness of the event.	"Medium"	Medium
WhoDomain		Domain	RESEARCH
WhereDomain		-
Program Name	The name of the executed program/process.	Image File Name	C:\utilities\unied.exe