← 03 — Blog

Is command-line logging actually on? A two-minute check

Tooling2 min read

Process creation events (4688) without the command line are among the most common half-configured sources on Windows. The event arrives, the rule that matches powershell.exe fires, and the field you need to decide whether it is an administrator or an attacker is empty. Two settings have to be on, and they live in different parts of Group Policy.

The check

In an elevated PowerShell on the machine:

# 1. Is the Process Creation subcategory audited?
auditpol /get /subcategory:"Process Creation"

# 2. Is the command line included?
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit' `
    -Name ProcessCreationIncludeCmdLine_Enabled -ErrorAction SilentlyContinue

# 3. Does it end up in the event?
cmd.exe /c echo ew-cmdline-test
Get-WinEvent -FilterHashtable @{ LogName = 'Security'; Id = 4688 } -MaxEvents 50 |
    Where-Object { $_.Message -like '*ew-cmdline-test*' } |
    Select-Object -First 1 TimeCreated, Message

On a localized Windows, use the subcategory GUID in step 1 instead of the English name; auditpol /list /subcategory:* /v lists them.

Reading the result

  • Step 1 shows No Auditing. No 4688 at all. Enable Audit Process Creation: Success under Advanced Audit Policy Configuration > Detailed Tracking.
  • Step 2 returns nothing or 0. Events arrive, but Process Command Line is empty. Enable Include command line in process creation events under Administrative Templates > System > Audit Process Creation.
  • Step 3 returns nothing although 1 and 2 look right. Group Policy may not have refreshed yet (gpupdate /force, then try again), or the Security log rolled over the event already on a very busy server; check right after running the test command.
  • Step 3 shows the test string. Done on this machine. Now find the same event in your SIEM and confirm the field is parsed, not just present in the raw message.

Fixing it at scale

Put both settings in the same GPO, so they cannot drift apart, and link it wherever you collect 4688. Microsoft documents the second setting in Command line process auditing. The audit policy check script checks both on any machine, together with the rest of the audit baseline.

Takeaway

Command lines contain whatever people type, including passwords passed as arguments. Once this is on, 4688 is sensitive data: restrict who can search it in the SIEM before you announce that it works.