Video Screencast Help
Symantec Secure Login will be live on Connect starting February 25. Get the details here.

Monitor Pack (MS6) - Windows - Monitoring System Proccesses

Created: 21 May 2009
Antonp's picture
0 0 Votes
Login to vote

Monitor pack for monitor Solution 6 (conversion to monitor Solution 7 in progress)

Windows NT and Windows 2000 include the ability to log the creation and destruction of each process on the system. To enable this feature, set the system's Audit policy to audit success and failure events in the "Detailed Tracking" category.

592 A new process has been created
593 A process has exited
594 A handle to an object has been duplicated
595 Indirect access to an object has been obtained