Unable to see 4688 events in event viewer

Question

I have all the settings as per https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/component-updates/command-line-process-auditing

However, I am unable to see any 4688 events in my event viewer.This started happening when I updated my windows(I have windows 11). Has anyone faced a similar issue. Also, how do I make sure I have all the settings in place using command line?

Answer 1

KB5020044 Fixes Process Creation Audit Logging - Event ID 4688/1108 Issue

To resolve the issue, install the November 29, 2022—KB5020044 (OS Build 22621.900) Preview Cumulative Update.

Improvements:

It addresses an issue that affects process creation. It fails to create security audits for it and other related audit events.