Windows 10: Event ID 4688 not showing anything, but 4696 does

Hi,I have turned on Local Security Policy: Advanced Audit Policy Configuration > System Audit Policies > Detailed Tracking > Audit Process Creation = Success. And according to this : https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-process-creation I should get both event 4688 and event 4696. But I only get logs for 4696. And they don't show all of the programs that were started. Also I implemented MS Security Baseline for Win 11 22H2 from here: https://www.microsoft.com/en-us/download/details.aspx?id=55319What else do I have to enable to get e

:)

 

Event viewer - Event id 4688

Hi,

you need to turn audit to view this event. See recommendations at
https://docs.microsoft.com/en-us/windows/securi...

 

Event viewer - Event id 4688

I tried to create a custom view, with Windows Logs as the event log, and 4688 as the event ID. I had no other changed settings, and I expected this to give me a stream of events showing whenever I opened an application. Instead I only got events related
to Microsoft processes.

I want to have this because I want to run a program whenever a specific program runs.

I wonder if there is a problem with how I created the custom view, or if there is a different way to see when a program

Edit : As per Igor Leyko's reply, I have tried to enable process auditing. I have done so in :

Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy\Audit process tracking

Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\System Audit Policies - Local Group Policy Object\Detailed Tracking\Audit Process Creation

But still it doesn't work, maybe I missed a setting, I'm not sure.

 

Event ID 10016, CLSID and APPID

Hey, I've been trying to resolve this same dcom issue myself, and I followed the steps you listed @FreeBooter, but when I try to do the last step, I firstly when clicking "edit" get a message saying



And then when I do enter the menu after clicking "ok" on that dialog box, the add button is greyed out.

I'm 100% certain I followed all the steps correctly. I triple-checked it. But no dice...