Windows SecurityDetailed Tracking

Event 4689: A process has exited.

A process has exited.

Technical Details

Windows Security Source

Event ID: 4689

Windows Security- Detailed Tracking

Event Description

A process has exited.

Key Log Fields

  • SubjectUserName - Account that ran the process
  • SubjectDomainName - Domain of the account
  • SubjectLogonId - Logon ID for correlation
  • ProcessId - Process ID that exited
  • ProcessName - Full path to the process executable
  • ExitStatus - Exit status code of the process

Contents