[{"data":1,"prerenderedAt":289},["ShallowReactive",2],{"doku:en:richtlinien-anhang\u002Fhilfe-microsoft-policies-auditing-includecmdline":3},{"seite":4,"start":34,"leiste":35,"bereich":288,"zurueck":288,"weiter":288},{"sprache":5,"rel":6,"zu":7,"id":8,"titel":9,"titelHtml":9,"beschreibung":10,"kennzeile":11,"imMenue":12,"html":13,"ueberschriften":14},"en","richtlinien-anhang\u002Fhilfe-microsoft-policies-auditing-includecmdline","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-microsoft-policies-auditing-includecmdline","referenz-hilfe-microsoft-policies-auditing-includecmdline","Include command line in process creation events","This setting adds the command line of a newly started process to process creation audit events.","since 0.9.8.11",false,"\u003Ch2 id=\"purpose\">Purpose\u003C\u002Fh2>\n\u003Cdetails class=\"doku-klappbox\">\u003Csummary>Show registry keys (1)\u003C\u002Fsummary>\u003Cdiv class=\"doku-klappbox-inhalt\">\n\u003Cul>\n\u003Cli>\u003Ccode>HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Audit\\ProcessCreationIncludeCmdLine_Enabled\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fdiv>\u003C\u002Fdetails>\n\u003Cp>This setting adds the command line of a newly started process to process creation audit events. When the value is enabled, Windows records the executable name and its supplied arguments in the Process Command Line field of event 4688.\u003C\u002Fp>\n\u003Cp>The setting does not generate process creation events by itself. It has an effect only when the Audit Process Creation subcategory is configured to produce event 4688. If the value is disabled or absent, the event's command-line field remains empty.\u003C\u002Fp>\n\u003Cp>The additional data provides more context for investigating process activity, including which script, subcommand, or command-line options were passed to an application.\u003C\u002Fp>\n\u003Ch2 id=\"notes\">Notes\u003C\u002Fh2>\n\u003Ch3 id=\"security\">Security\u003C\u002Fh3>\n\u003Cp>Command lines are stored as plain text in the Windows Security log. Arguments can contain passwords, access tokens, file paths, personal data, or other sensitive information. Accounts and services that can read the Security log can read this information from the affected events. The setting does not grant additional access to the log, but it increases the amount of information exposed through existing read permissions.\u003C\u002Fp>\n\u003Cp>Conversely, command-line data improves visibility into process activity and can support the detection and forensic analysis of suspicious application or script execution.\u003C\u002Fp>\n\u003Ch3 id=\"notes-1\">Notes\u003C\u002Fh3>\n\u003Cp>\u003Ccode>ProcessCreationIncludeCmdLine_Enabled\u003C\u002Fcode> is a \u003Ccode>REG_DWORD\u003C\u002Fcode> value. A value of \u003Ccode>1\u003C\u002Fcode> represents the enabled policy state. A value of \u003Ccode>0\u003C\u002Fcode>, or an absent value, causes event 4688 not to include the process command line as a result of this setting.\u003C\u002Fp>\n\u003Cp>The Process Command Line field is available starting with version 1 of event 4688, introduced in Windows 8.1 and Windows Server 2012 R2.\u003C\u002Fp>\n\u003Ch3 id=\"microsoft-documentation\">Microsoft documentation\u003C\u002Fh3>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Fpolicy-csp-admx-auditsettings#includecmdline\">Microsoft Learn: Policy CSP – ADMX_AuditSettings, IncludeCmdLine\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fprevious-versions\u002Fwindows\u002Fit-pro\u002Fwindows-10\u002Fsecurity\u002Fthreat-protection\u002Fauditing\u002Fevent-4688\">Microsoft Learn: 4688(S) — A new process has been created\u003C\u002Fa>\u003C\u002Fp>\n\u003Ch2 id=\"see-also\">See also\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>\u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-protokollierung-ueberwachung#e-0f5ff7a384\">Entry in the reference\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n",[15,19,22,26,28,31],{"ebene":16,"id":17,"text":18},2,"purpose","Purpose",{"ebene":16,"id":20,"text":21},"notes","Notes",{"ebene":23,"id":24,"text":25},3,"security","Security",{"ebene":23,"id":27,"text":21},"notes-1",{"ebene":23,"id":29,"text":30},"microsoft-documentation","Microsoft documentation",{"ebene":16,"id":32,"text":33},"see-also","See also","\u002Fen\u002Fdocumentation",[36,56,68,76,124,144,160,176,200,216,232],{"titel":37,"pfad":38,"seiten":39},"Getting started","erste-schritte",[40,44,48,52],{"rel":41,"titel":42,"zu":43},"erste-schritte\u002Fwas-ist-setup-foundry","Setup Foundry","\u002Fen\u002Fdocumentation\u002Ferste-schritte\u002Fwas-ist-setup-foundry",{"rel":45,"titel":46,"zu":47},"erste-schritte\u002Finstallation","Installing Setup Foundry","\u002Fen\u002Fdocumentation\u002Ferste-schritte\u002Finstallation",{"rel":49,"titel":50,"zu":51},"erste-schritte\u002Fschnellstart","Quick start","\u002Fen\u002Fdocumentation\u002Ferste-schritte\u002Fschnellstart",{"rel":53,"titel":54,"zu":55},"erste-schritte\u002Fablauf","How it works","\u002Fen\u002Fdocumentation\u002Ferste-schritte\u002Fablauf",{"titel":57,"pfad":58,"seiten":59},"Setup","wizard",[60,64],{"rel":61,"titel":62,"zu":63},"wizard\u002Fuebersicht","The setup wizard","\u002Fen\u002Fdocumentation\u002Fwizard\u002Fuebersicht",{"rel":65,"titel":66,"zu":67},"wizard\u002Fsystemanforderungen","System requirements","\u002Fen\u002Fdocumentation\u002Fwizard\u002Fsystemanforderungen",{"titel":69,"pfad":70,"seiten":71},"Setup in detail","einrichtung-detail",[72],{"rel":73,"titel":74,"zu":75},"einrichtung-detail\u002Fwindows-quelle","Import an ISO","\u002Fen\u002Fdocumentation\u002Feinrichtung-detail\u002Fwindows-quelle",{"titel":77,"pfad":78,"seiten":79},"Foundry","konfiguration",[80,84,88,92,96,100,104,108,112,116,120],{"rel":81,"titel":82,"zu":83},"konfiguration\u002Fprofile","Profiles","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fprofile",{"rel":85,"titel":86,"zu":87},"konfiguration\u002Fquellen","Sources","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fquellen",{"rel":89,"titel":90,"zu":91},"konfiguration\u002Fbenutzer","Configuring users","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fbenutzer",{"rel":93,"titel":94,"zu":95},"konfiguration\u002Fbilder","Background picture and logo","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fbilder",{"rel":97,"titel":98,"zu":99},"konfiguration\u002Fwindows-bereinigen","Cleaning up Windows","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fwindows-bereinigen",{"rel":101,"titel":102,"zu":103},"konfiguration\u002Fapps-entfernen","Removing apps","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fapps-entfernen",{"rel":105,"titel":106,"zu":107},"konfiguration\u002Fauswaehlen","Selecting applications","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fauswaehlen",{"rel":109,"titel":110,"zu":111},"konfiguration\u002Frichtlinien","Policies","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien",{"rel":113,"titel":114,"zu":115},"konfiguration\u002Fpc-informationen","PC information","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fpc-informationen",{"rel":117,"titel":118,"zu":119},"konfiguration\u002Fnamensschema","Naming scheme","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fnamensschema",{"rel":121,"titel":122,"zu":123},"konfiguration\u002Finstall-assist-gestalten","Design the Install Assist","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Finstall-assist-gestalten",{"titel":125,"pfad":126,"seiten":127},"Installation","installationsmedien",[128,132,136,140],{"rel":129,"titel":130,"zu":131},"installationsmedien\u002Fusb-stick","Create a USB drive","\u002Fen\u002Fdocumentation\u002Finstallationsmedien\u002Fusb-stick",{"rel":133,"titel":134,"zu":135},"installationsmedien\u002Fiso-erstellen","Creating an ISO","\u002Fen\u002Fdocumentation\u002Finstallationsmedien\u002Fiso-erstellen",{"rel":137,"titel":138,"zu":139},"installationsmedien\u002Fvhd-erstellen","Create VHD","\u002Fen\u002Fdocumentation\u002Finstallationsmedien\u002Fvhd-erstellen",{"rel":141,"titel":142,"zu":143},"installationsmedien\u002Finstall-assist","Install Assist on the target computer","\u002Fen\u002Fdocumentation\u002Finstallationsmedien\u002Finstall-assist",{"titel":145,"pfad":146,"seiten":147},"Machines","pruefmaschine",[148,152,156],{"rel":149,"titel":150,"zu":151},"pruefmaschine\u002Fhyper-v-berechtigungen","Hyper-V permissions","\u002Fen\u002Fdocumentation\u002Fpruefmaschine\u002Fhyper-v-berechtigungen",{"rel":153,"titel":154,"zu":155},"pruefmaschine\u002Fverwenden","Use the test machine","\u002Fen\u002Fdocumentation\u002Fpruefmaschine\u002Fverwenden",{"rel":157,"titel":158,"zu":159},"pruefmaschine\u002Ferstellen","Create a machine","\u002Fen\u002Fdocumentation\u002Fpruefmaschine\u002Ferstellen",{"titel":161,"pfad":162,"seiten":163},"Editions","editionen",[164,168,172],{"rel":165,"titel":166,"zu":167},"editionen\u002Fvergleich","Editions at a glance","\u002Fen\u002Fdocumentation\u002Feditionen\u002Fvergleich",{"rel":169,"titel":170,"zu":171},"editionen\u002Flizenz-aktivieren","Activate a license","\u002Fen\u002Fdocumentation\u002Feditionen\u002Flizenz-aktivieren",{"rel":173,"titel":174,"zu":175},"editionen\u002Faktivierungen-zuruecksetzen","Reset activations","\u002Fen\u002Fdocumentation\u002Feditionen\u002Faktivierungen-zuruecksetzen",{"titel":177,"pfad":178,"seiten":179},"Troubleshooting","fehler",[180,184,188,192,196],{"rel":181,"titel":182,"zu":183},"fehler\u002Fusb","USB drive problems","\u002Fen\u002Fdocumentation\u002Ffehler\u002Fusb",{"rel":185,"titel":186,"zu":187},"fehler\u002Fiso","ISO import problems","\u002Fen\u002Fdocumentation\u002Ffehler\u002Fiso",{"rel":189,"titel":190,"zu":191},"fehler\u002Fhyperv","Hyper-V problems","\u002Fen\u002Fdocumentation\u002Ffehler\u002Fhyperv",{"rel":193,"titel":194,"zu":195},"fehler\u002Finstall-assist","When Setup fails on the target computer","\u002Fen\u002Fdocumentation\u002Ffehler\u002Finstall-assist",{"rel":197,"titel":198,"zu":199},"fehler\u002Fantwortdatei","The answer file","\u002Fen\u002Fdocumentation\u002Ffehler\u002Fantwortdatei",{"titel":201,"pfad":202,"seiten":203},"Reference","referenz",[204,208,212],{"rel":205,"titel":206,"zu":207},"referenz\u002Fbekannte-probleme","Known issues","\u002Fen\u002Fdocumentation\u002Freferenz\u002Fbekannte-probleme",{"rel":209,"titel":210,"zu":211},"referenz\u002Fdiagnose-und-protokolle","Diagnostics and logs","\u002Fen\u002Fdocumentation\u002Freferenz\u002Fdiagnose-und-protokolle",{"rel":213,"titel":214,"zu":215},"referenz\u002Fglossar","Glossary","\u002Fen\u002Fdocumentation\u002Freferenz\u002Fglossar",{"titel":217,"pfad":218,"seiten":219},"Windows appendix","windows-anhang",[220,224,228],{"rel":221,"titel":222,"zu":223},"windows-anhang\u002Fdienste","Services","\u002Fen\u002Fdocumentation\u002Fwindows-anhang\u002Fdienste",{"rel":225,"titel":226,"zu":227},"windows-anhang\u002Faufgaben","Scheduled tasks","\u002Fen\u002Fdocumentation\u002Fwindows-anhang\u002Faufgaben",{"rel":229,"titel":230,"zu":231},"windows-anhang\u002Fapps","App packages","\u002Fen\u002Fdocumentation\u002Fwindows-anhang\u002Fapps",{"titel":233,"pfad":234,"seiten":235},"Policy appendix","richtlinien-anhang",[236,240,244,248,252,256,260,264,268,272,276,280,284],{"rel":237,"titel":238,"zu":239},"richtlinien-anhang\u002Frichtlinien","Policy reference","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien",{"rel":241,"titel":242,"zu":243},"richtlinien-anhang\u002Frichtlinien-office-haertung","Office hardening","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-office-haertung",{"rel":245,"titel":246,"zu":247},"richtlinien-anhang\u002Frichtlinien-edge-internet-explorer","Edge and Internet Explorer","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-edge-internet-explorer",{"rel":249,"titel":250,"zu":251},"richtlinien-anhang\u002Frichtlinien-virenschutz-angriffsflaechen","Virus protection and attack surface","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-virenschutz-angriffsflaechen",{"rel":253,"titel":254,"zu":255},"richtlinien-anhang\u002Frichtlinien-netzwerk-freigaben","Network and file sharing","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-netzwerk-freigaben",{"rel":257,"titel":258,"zu":259},"richtlinien-anhang\u002Frichtlinien-datenschutz-telemetrie","Privacy and telemetry","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-datenschutz-telemetrie",{"rel":261,"titel":262,"zu":263},"richtlinien-anhang\u002Frichtlinien-protokollierung-ueberwachung","Logging and auditing","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-protokollierung-ueberwachung",{"rel":265,"titel":266,"zu":267},"richtlinien-anhang\u002Frichtlinien-anmeldung-konten","Sign-in and accounts","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-anmeldung-konten",{"rel":269,"titel":270,"zu":271},"richtlinien-anhang\u002Frichtlinien-geraete-wechselmedien","Devices and removable media","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-geraete-wechselmedien",{"rel":273,"titel":274,"zu":275},"richtlinien-anhang\u002Frichtlinien-kernschutz","Kernel protection","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-kernschutz",{"rel":277,"titel":278,"zu":279},"richtlinien-anhang\u002Frichtlinien-laufwerksverschluesselung","Drive encryption","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-laufwerksverschluesselung",{"rel":281,"titel":282,"zu":283},"richtlinien-anhang\u002Frichtlinien-windows-update","Windows Update","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-windows-update",{"rel":285,"titel":286,"zu":287},"richtlinien-anhang\u002Frichtlinien-grundeinstellungen","Defaults and privacy settings","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-grundeinstellungen",null,1793199128245]