Question

You are posting a reply to: Event ID 4688 not showing anything, but 4696 does

The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to our Community FAQs for details. All submitted content is subject to our Terms of Use.

All Answers

  • Author
    Replies
    • #4006212
      Avatar photo

      Time to call it in.

      by rproffitt ·

      In reply to Event ID 4688 not showing anything, but 4696 does

      This could be one of the numerous Windows 11 bugs. This doesn’t appear fixable except by Microsoft.

    • #4013327

      Reply To: Event ID 4688 not showing anything, but 4696 does

      by Johnharper2020 ·

      In reply to Event ID 4688 not showing anything, but 4696 does

      This seems to be a bug in 22H2. Instead, you’ll find a vast number of Event ID 1108 Auditing entries. As of now, there is no fix (to my knowledge.) However, please post this in the IT Pro forum as well.

      Hope this helps,
      John

    • #4017365

      Reply To: Event ID 4688 not showing anything, but 4696 does

      by Johnharper2020 ·

      In reply to Event ID 4688 not showing anything, but 4696 does

      You must enable the Audit Process Creation audit policy so that 4688 events are generated. You can enable this audit policy from the following Group Policy Object (GPO) container: Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\System Audit Policies\Detailed Tracking.

Viewing 2 reply threads