The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →To capture process command lines in Windows, enable two device policies: Audit Process Creation with Success auditing, and Include command line in process creation events. The first generates Security event 4688 when a process starts; the second adds its command-line details. Deploy both through an Intune device configuration profile, then verify the resulting events on a test device. Command lines are stored in plain text, so assess the privacy and access implications before broad deployment.
Why two policies are required
The settings perform different jobs and are complementary, not alternatives:
As an Amazon Associate I earn from qualifying purchases.
- Audit Process Creation enables Windows to record a process-start audit event. Its Audit Policy CSP identifier is
./Device/Vendor/MSFT/Policy/Config/Audit/DetailedTracking_AuditProcessCreation. Set it to1for Success auditing. The CSP also defines0as Off/None,2as Failure, and3as Success and Failure. Microsoft recommends Success auditing for process-start monitoring; its guidance notes that this subcategory has no Failure events. Microsoft’s Audit Policy CSP documentation and process-creation audit guidance describe the setting and its behavior. - Include command line in process creation events adds command-line data to the event. Its ADMX-backed CSP identifier is
./Device/Vendor/MSFT/Policy/Config/ADMX_AuditSettings/IncludeCmdLine. It only applies when Audit Process Creation is enabled and requires a string/character SyncML format when configured through the CSP. See Microsoft’s ADMX_AuditSettings CSP documentation.
Windows records process creation as Security event ID 4688, “A new process has been created.” The Process Command Line field is empty by default; enabling the second policy alongside process-creation auditing makes that field available. Microsoft’s event 4688 reference explains the event fields.
Check Windows edition and build support
Confirm that the target devices meet the applicability requirements for both CSP settings before assigning a profile. Microsoft lists Pro, Enterprise, Education, and IoT Enterprise editions for these policies, but the minimum supported versions differ:
#1 Best Overall
- The Audit Policy CSP lists Windows 10 Pro, Enterprise, Education, and IoT Enterprise, with support beginning at Windows 10 version 1803 plus specified servicing updates; it also lists Windows 10 version 2004 and later.
- The IncludeCmdLine CSP lists Windows 10 version 2004, 20H2, and 21H1 with KB5005101 and later, and Windows 11 version 21H2 and later.
Use the live Audit CSP and ADMX_AuditSettings CSP pages to check current applicability for the precise builds in your fleet. The IncludeCmdLine policy is device-scoped.
Configure both policies in Intune
Intune’s Settings Catalog provides a way to configure settings exposed through Windows CSPs and create assignable device configuration profiles. Microsoft’s documentation establishes that general mechanism, but it does not confirm that both settings appear in every tenant’s current catalog or establish a universal click path for them. Check the current tenant for the named settings before relying on catalog configuration. If using a custom CSP profile, use the verified CSP identifiers above and confirm the required SyncML string serialization for IncludeCmdLine; do not assume an unverified XML payload.
- Confirm applicability. Check that the test devices’ Windows editions and builds are covered by both CSP entries.
- Create a device configuration profile. In Intune, use a supported profile mechanism for the device-scoped settings. Microsoft documents Settings Catalog profiles and assignment generally in its Settings Catalog documentation; availability of these particular controls can vary by tenant.
- Set process auditing to Success. Configure
./Device/Vendor/MSFT/Policy/Config/Audit/DetailedTracking_AuditProcessCreationwith value1. - Enable command-line inclusion. Configure
./Device/Vendor/MSFT/Policy/Config/ADMX_AuditSettings/IncludeCmdLine. For a custom CSP payload, use the string/character SyncML format required by the policy and validate the serialization in your environment before deployment. - Assign to a test group. Start with a limited set of devices rather than the full fleet.
- Verify on a test device. After policy application, inspect newly generated Security event 4688 records and check whether the Process Command Line field is populated. Also confirm the effective audit policy and whether another management source is overriding it.
- Expand only after operational checks. Validate event generation, command-line visibility, log access, collection, and retention needs before broadening assignment.
Protect the command-line data
Command lines are written in plain text to the Security event log. Microsoft warns that anyone permitted to read those events can also read the command-line arguments for successfully created processes; applications may put passwords or user data in those arguments. Treat the events and any forwarded or exported copies as sensitive. Review which applications pass sensitive values on command lines, restrict access to the Security log and downstream collections, and align retention with your organization’s security and privacy requirements. Microsoft states that anyone with access to read the security events can read the arguments in its ADMX_AuditSettings CSP documentation.
Recommended Free Tools
Plan for event volume and policy conflicts
Process-creation event volume depends on how a device is used. Microsoft characterizes it as medium to high depending on process activity, rather than giving a universal event count. Measure activity and collection volume on representative devices, then size log capacity and retention for your own workload. Audit Policy CSP guidance and Microsoft’s process-creation audit guidance discuss this volume consideration.
Rank #3
Also check for other policy sources that configure auditing. Microsoft cautions that Advanced Audit Policy Configuration can be overridden by basic audit policy settings and describes the force-subcategory setting as a way to prevent such conflicts in Group Policy. In an Intune-managed fleet, verify the effective policy and resolve competing management settings through the appropriate management source; a Group Policy-only remedy is not automatically the right deployment path.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
