| Event Id | 592 |
| Source | Security |
| Description | A new process has been created: New Process ID: %1 Image File Name: %2 Creator Process ID: %3 User Name: %4 Domain: %5 Logon ID: %6 |
| Event Information | Cause: A user or service started a program successfully. When this program is closed, a corresponding Security 593 message is logged, which indicates that the program was successfully closed and is no longer running. Associated messages have the same Process ID number. Resolution: No user action is required. Related Events: Event ID: 593, Event Source: Security |
| Reference Links | Event ID 592 from Source Security Alternate Event ID in Vista and Windows Server 2008 is 4688. Security Event for Associating Service Account Logon Events |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.