How to Enable Command Line Process Creation Auditing with Event ID 4688 via PowerShell in Windows 11

When investigating security incidents, malicious activity, or unintended software behaviour on Windows 11, process tracking is one of the most critical defensive disciplines. By default, Windows logs Event ID 4688 in the Security event log whenever a new process spawns. However, out-of-the-box settings only capture the process name and initiating parent PID, completely omitting the actual command-line arguments executed. Without command-line parameters, security teams cannot determine whether a PowerShell or cmd.exe instance ran a benign administrative script or executed an obfuscated encoded payload. By combining auditpol with registry-level command-line auditing, administrators can activate comprehensive process telemetry.

Understanding Event ID 4688 and Process Telemetry

Event ID 4688 is generated by the Windows Security subsystem whenever an application or service requests the operating system kernel to instantiate an executable binary. A fully configured Event ID 4688 record includes:

• New Process Name: The full filesystem path to the executable (e.g., C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe).
• Process Command Line: The exact raw string, flags, script paths, and parameters supplied at launch (e.g., -ExecutionPolicy Bypass -File C:\Scripts\deploy.ps1).
• Creator Process ID / Name: The parent process that spawned the child binary, enabling analysts to reconstruct full process execution trees.
• Token Elevation Type: Details whether the binary was executed under standard user rights or elevated administrative privileges.

Enabling Process Creation Auditing Using Auditpol

To enable logging of process creation events in the local security log, you must activate the subcategory within the Detailed Tracking audit policy:

1. Open an elevated PowerShell console by clicking Start, searching for PowerShell, right-clicking the icon, and selecting Run as administrator.
2. Query the current state of Process Creation auditing:

auditpol /get /subcategory:"Process Creation"

If the policy displays “No Auditing”, enable Success tracking using the following command:

auditpol /set /subcategory:"Process Creation" /success:enable /failure:disable

This instructs the Local Security Authority Subsystem Service (LSASS) to log Event ID 4688 to the Security log whenever any binary launches successfully.

Activating Full Command-Line Argument Capture via PowerShell

Enabling Process Creation alone does not capture argument strings. To capture the entire command-line payload, you must configure the administrative system policy registry key:

$regPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit"

if (-not (Test-Path $regPath)) {
    New-Item -Path $regPath -Force | Out-Null
}

Set-ItemProperty -Path $regPath -Name "ProcessCreationIncludeCmdLine_Enabled" -Value 1 -Type DWord -Force

Setting ProcessCreationIncludeCmdLine_Enabled to 1 instructs the kernel to append the full launch arguments into the Process Command Line field of Event ID 4688 records immediately, with no system reboot required.

Querying and Filtering Event ID 4688 Logs with Get-WinEvent

Once activated, you can inspect incoming process telemetry directly from PowerShell without manually navigating Event Viewer:

Get-WinEvent -FilterHashtable @{
    LogName = 'Security'
    Id = 4688
} -MaxEvents 15 | ForEach-Object {
    [PSCustomObject]@{
        TimeCreated = $_.TimeCreated
        ProcessName = $_.Properties[5].Value
        CommandLine = $_.Properties[8].Value
        ParentProcess = $_.Properties[13].Value
    }
} | Format-Table -Wrap

This script parses the raw event properties, extracting the execution timestamp, target executable, parent process, and complete command-line payload into a clean, human-readable console table.

Security and Operational Considerations

While command-line auditing provides indispensable forensic visibility, security professionals must observe key operational principles:

• Credential Hygiene: Command-line auditing captures all plain-text arguments. If scripts or administrators execute utilities that accept credentials directly on the command line (such as net use /user:... password), those credentials will be permanently recorded in the Security event log. Always use secure credential stores or PSCredential prompts.
• Log Rotation Size: Detailed process tracking increases the rate of Security log growth. Ensure the maximum Security log capacity is adjusted via wevtutil sl Security /ms:104857600 (100 MB) or higher to prevent premature log overwrites during forensic investigations.