ZEKASTRA

SecurityProcess and object access

4689 · A process has exited

Generated every time a process exits. Records the process name, its ID and the exit status.

01Fields in the event

  • SubjectUserSid
  • SubjectUserName
  • SubjectDomainName
  • SubjectLogonId
  • Status
  • ProcessId
  • ProcessName

02How to use it

Pair with 4688 on ProcessId and ProcessName to estimate how long a program ran.

03Caveats

Requires Audit Process Termination. The meaning of the exit Status is defined by each application.

05Sources

  1. Microsoft Learn — 4689(S) A process has exited checked 2026-10-18

Contact and service requests

Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.