Event ID:
4696
Category:
Detailed Tracking
Subcategory:
Process Creation
Supported on:
Windows Vista, Windows Server 2008
A primary token was assigned to process.
Subject:
Security ID: %1
Account Name: %2
Account Domain: %3
Logon ID: %4
Process Information:
Process ID: %11
Process Name: %12
Target Process:
Target Process ID: %9
Target Process Name: %10
New Token Information:
Security ID: %5
Account Name: %6
Account Domain: %7
Logon ID: %8