Event Details
User Activity->Programs Execution->Windows 2000-2003->EventID 593 - A process has exited [Win 2003 / XP]
EventID 593 - A process has exited [Win 2003 / XP]
 Sample: 
        Event Type:     Success Audit
        Event Source:   Security
        Event Category: Detailed Tracking
        Event ID:       593
        Date:           10/26/2009
        Time:           07:31:43
        User:           RESEARCH\ALebovsky
        Computer:       DC1
        Description:
        A process has exited:
        Process ID:	2548
        Image File Name:	C:\utilities\auditon.exe
        User Name:	Alebovsky
        Domain:		RESEARCH
        Logon ID:		(0x0,0x59DF36)
Log Type: Windows Event Log
 Uniquely Identified By:
Log Name: Security
Filtering Field Equals to Value
OSVersion Windows 2003
Windows XP
Category Detailed Tracking
Source Security
EventId 593
Field Matching
FieldDescriptionStored inSample Value
When At what date and time a user activity originated in the system. DateTime 12/14/2009 6:59:09 AM
Who Account or user name under which the activity occured. User Name Alebovsky
What The type of activity occurred (e.g. Logon, Password Changed, etc.) "Process Terminated" Process Terminated
Where The name of the workstation/server where the activity was logged. Computer DC1
Where From The name of the workstation/server where the activity was initiated from. - 10.10.10.10
Severity Specify the seriousness of the event. "Medium" Medium
WhoDomain Domain RESEARCH
WhereDomain -
Program Name The name of the executed program/process. Image File Name C:\utilities\auditon.exe
Comments
You must be logged in to comment