Event Details
Operating System->Microsoft Windows->Built-in logs->Windows 2000-2003->Security Log->Detailed Tracking->EventID 593 - A process has exited [Win 2003 / XP]
EventID 593 - A process has exited [Win 2003 / XP]
Indicates a successful closing/termination of a program by user.

Note:
  • In order to find out when the ended process started look for a preceding event 593 with the same Process ID.
  • The Windows 2000 version of this event is missing Image File Name field reflecting the name of the program. In order to find out the program name you must find the preceding Event ID 592.
Find more information about this event on ultimatewindowssecurity.com.

Corresponding events on other OS versions:

Windows 2000 Windows 2008 Related Events:
To find out when the process started look for the following event with the same Process ID:
 Sample: 
        Event Type:     Success Audit
        Event Source:   Security
        Event Category: Detailed Tracking
        Event ID:       593
        Date:           10/26/2009
        Time:           07:31:43
        User:           RESEARCH\ALebovsky
        Computer:       DC1
        Description:
        A process has exited:
        Process ID:	2548
        Image File Name:	C:\utilities\auditon.exe
        User Name:	Alebovsky
        Domain:		RESEARCH
        Logon ID:		(0x0,0x59DF36)
Log Type: Windows Event Log
 Uniquely Identified By:
Log Name: Security
Filtering Field Equals to Value
OSVersion Windows 2003
Windows XP
Category Detailed Tracking
Source Security
EventId 593
Field Matching
FieldDescriptionStored inSample Value
DateTime Date/Time of event origination in GMT format. DateTime 10.10.2000 19:00:00
Source Name of an Application or System Service originating the event. Source Security
Type Warning, Information, Error, Success, Failure, etc. Type Success
User Domain\Account name of user/service/computer initiating event. User RESEARCH\Alebovsky
Computer Name of server workstation where event was logged. Computer DC1
EventID Numerical ID of event. Unique within one Event Source. EventId 576
Description The entire unparsed event message. Description Special privileges assigned to new logon.
Log Name The name of the event log (e.g. Application, Security, System, etc.) LogName Security
Category A name for a subclass of events within the same Event Source. Category Logon/Logoff
Process ID Uniquely identifies the process to correlate to it in other events InsertionString1 2548
Image File Name Full path to the executable InsertionString2 C:\utilities\auditon.exe
Domain Domain of the user who ended the process InsertionString4 RESEARCH
Logon ID ID of the logon session of the user who ended the process. Allows to find other events initiated by the user in the same logon session. InsertionString5 (0x0,0x59DF36)
User Name The user who ended the process InsertionString3 Alebovsky
Comments
You must be logged in to comment