Event ID 4689: A process has exited
Written when a process ends, with its exit status.
- Log
- Security
- Category
- Process
Why it matters
- With 4688, shows how long a process ran. Very short-lived tools can be a sign of scripted activity.
What to check
Match the Process ID and name to the 4688 that started it.
How to turn it on
Advanced Audit Policy: Detailed Tracking > Audit Process Termination.