STIG ID: WN11-AU-000585 | SRG: SRG-OS-000037-GPOS-00015 | Severity: medium | CCI: | Vulnerability Id: V-257770
When this policy setting is enabled, the operating system generates audit events when a process fails to start and the name of the program or user that created it.
These audit events can assist in understanding how a computer is being used and tracking user activity.
Go to Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> Detailed Tracking >> Set "Audit Process Creation" to "Failure".
Ensure Audit Process Creation auditing has been enabled:
Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> Detailed Tracking >> Set to "Failure".
If "Audit Process Creation" is not set to "Failure", this is a finding.