Process Creation
|
Audit events generated when a process is created or starts. The name of the application or user that created the process is also audited.
|
Process Termination
|
Audit events generated when a process ends.
|
DPAPI Activity
|
Audit events generated when encryption or decryption requests are made to the Data Protection application interface (DPAPI). DPAPI is used to protect secret information such as stored password and key information. For more information about DPAPI, see Windows Data Protection.
|
RPC Events
|
Audit inbound remote procedure call (RPC) connections.
|
