Audit process creation events

Using standard Windows auditing mechanisms, you can log all process creation events, which can be a powerful tool for troubleshooting or analysis. This also works in the Home editions of Windows.

This PowerShell function filters the event log and extracts the relevant data from it:

function Get-ProcessAuditEvents {
	
	[CmdletBinding()]
	param(
		[long]
		$MaxEvents = [long]::MaxValue,
		
		[datetime]
		$StartTime = [datetime]::MinValue
	);

	Get-WinEvent -MaxEvents $MaxEvents -FilterHashtable @{
		LogName = 'Security';
		Id = 4688;
		StartTime = $StartTime;
	} | ForEach-Object -Process {
		function Get-EventData( [string] $Name ) {
			$xml.Event.EventData.Data | Where-Object -Property 'Name' -EQ -Value $Name | Select-Object -ExpandProperty 'InnerText';
		}
		[xml] $xml = $_.ToXml();
		[pscustomobject] [ordered] @{
			TimeCreated = $_.TimeCreated;
			ParentProcessId = [int] ( Get-EventData -Name 'ProcessId' );
			ParentProcessPath = Get-EventData -Name 'ParentProcessName';
			NewProcessId = [int] ( Get-EventData -Name 'NewProcessId' );
			NewProcessPath = Get-EventData -Name 'NewProcessName';
			CommandLine = Get-EventData -Name 'CommandLine';
			TokenElevationType = switch ( Get-EventData -Name 'TokenElevationType' ) {
				'%%1936' { 'Full'; }
				'%%1937' { 'Elevated'; }
				'%%1938' { 'Limited'; }
			};
			SubjectUserSid = [System.Security.Principal.SecurityIdentifier] ( Get-EventData -Name 'SubjectUserSid' );
			SubjectUserName = Get-EventData -Name 'SubjectUserName';
		};
	};
}

Get-ProcessAuditEvents.ps1

Since the function queries the Security log, it must be run with elevated permissions. Call the function as follows:

PS C:\> Get-ProcessAuditEvents -MaxEvents 100 | Where-Object -Property 'CommandLine' -Match -Value 'notepad' | Format-List

TimeCreated        : 2026-10-22 02:28:56
ParentProcessId    : 8076
ParentProcessPath  : C:\Windows\explorer.exe
NewProcessId       : 17264
NewProcessPath     : C:\Windows\System32\notepad.exe
CommandLine        : "C:\Windows\system32\notepad.exe"
TokenElevationType : Full
SubjectUserSid     : S-1-5-21-737974762-1268198399-203996958-1001
SubjectUserName    : Christoph