Include command line in process creation events

Purpose

Show registry keys (1)

• HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit\ProcessCreationIncludeCmdLine_Enabled

This setting adds the command line of a newly started process to process creation audit events. When the value is enabled, Windows records the executable name and its supplied arguments in the Process Command Line field of event 4688.

The setting does not generate process creation events by itself. It has an effect only when the Audit Process Creation subcategory is configured to produce event 4688. If the value is disabled or absent, the event's command-line field remains empty.

The additional data provides more context for investigating process activity, including which script, subcommand, or command-line options were passed to an application.

Notes

Security

Command lines are stored as plain text in the Windows Security log. Arguments can contain passwords, access tokens, file paths, personal data, or other sensitive information. Accounts and services that can read the Security log can read this information from the affected events. The setting does not grant additional access to the log, but it increases the amount of information exposed through existing read permissions.

Conversely, command-line data improves visibility into process activity and can support the detection and forensic analysis of suspicious application or script execution.

Notes

ProcessCreationIncludeCmdLine_Enabled is a REG_DWORD value. A value of 1 represents the enabled policy state. A value of 0, or an absent value, causes event 4688 not to include the process command line as a result of this setting.

The Process Command Line field is available starting with version 1 of event 4688, introduced in Windows 8.1 and Windows Server 2012 R2.

Microsoft documentation

Microsoft Learn: Policy CSP – ADMX_AuditSettings, IncludeCmdLine

Microsoft Learn: 4688(S) — A new process has been created

See also

• Entry in the reference