Event Details
User Activity->Programs Execution->Windows 2000-2003->EventID 593 - A process has exited [Win 2000]
EventID 593 - A process has exited [Win 2000]
 Sample:
        Event Type:     Success Audit
        Event Source:   Security
        Event Category: Detailed Tracking
        Event ID:       593
        Date:           11/13/2009
        Time:           11:32:54
        User:           LOGISTICS\ALebovsky
        Computer:       DCCC1
        Description:
        A process has exited:
        Process ID:	1312
        User Name:	ALebovsky
        Domain:		LOGISTICS
        Logon ID:		(0x0,0xB117)
      
Log Type: Windows Event Log
 Uniquely Identified By:
Log Name: Security
Filtering Field Equals to Value
OSVersion Windows 2000
Category Detailed Tracking
Source Security
EventId 593
Field Matching
FieldDescriptionStored inSample Value
When At what date and time a user activity originated in the system. DateTime 12/14/2009 6:59:09 AM
Who Account or user name under which the activity occured. User Name ALebovsky
What The type of activity occurred (e.g. Logon, Password Changed, etc.) "Process Terminated" Process Terminated
Where The name of the workstation/server where the activity was logged. Computer DC1
Where From The name of the workstation/server where the activity was initiated from. - 10.10.10.10
Severity Specify the seriousness of the event. "Medium" Medium
WhoDomain Domain LOGISTICS
WhereDomain -
Program Name The name of the executed program/process. Process ID 1312
Comments
You must be logged in to comment