iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A Command Line Event Log usually means Windows telemetry that records which executable started and which arguments it received. The main native source is Security Event ID 4688, but command-line data appears only when Audit Process Creation and Include command line in process creation events are both enabled; Sysmon and PowerShell logging provide complementary detail.
Administrators commonly use the phrase to describe several related sources rather than one universal Windows log. Choosing the correct source prevents a common mistake: expecting a process-start event to reveal every command later executed inside a shell or PowerShell session.
Key takeaways
- Windows has no single universal “command line event log”; the main native record is Security Event ID 4688, which records process creation and can include the executable’s arguments.
- Event 4688 requires both Audit Process Creation and Include command line in process creation events; enabling only one policy can leave the command-line field empty.
- Sysmon Event ID 1 adds full command lines, parent-process context, hashes, and a Process GUID, while PowerShell Event ID 4104 records PowerShell script-block content rather than merely the PowerShell process launch.
- Command-line and script logs can expose passwords, tokens, personal data, and other secrets, so access control, retention, and protected logging must be designed before collection is enabled.
- Windows Event Forwarding centralizes events that endpoints already generate; WEF cannot recreate command-line fields that were never logged locally.
What is a Command Line Event Log?
A Command Line Event Log usually means Windows event telemetry that records the executable launched and the arguments passed to it, rather than a single log with that exact name. The principal native source is Security Event ID 4688, “A new process has been created.” Sysmon Event ID 1 provides richer process-start context, and PowerShell Event ID 4104 records PowerShell script blocks when the relevant policies are enabled.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →The distinction matters because process logging and script-content logging answer different questions:
Popular on Amazon
- Mr. Pen lined spiral journal notebook includes 160 lined pages, 1 pen, and divider sticky tabs, providing a complete set for note-taking, journaling, schoolwork, daily planning, and organized writing.
- The notebook is made with 100 GSM paper and a durable hardcover, offering a smooth writing surface and sturdy construction for everyday use at school, work, home, or on the go.
- Measuring 5.7" x 7.9", this A5 notebook provides a compact yet practical writing space for class notes, meeting notes, lists, reflections, and daily plans.
- The college-ruled lined pages help keep writing neat and structured, while the spiral binding allows the notebook to lay flat for a more comfortable writing experience.
- The included pen, divider sticky tabs, and inner storage pocket help keep essentials organized, making this notebook suitable for students, teachers, professionals, writers, and daily planners.
| Source | What it records | Best question it answers | Important condition |
|---|---|---|---|
| Security Event ID 4688 | Process creation, process identity, creator information, and command-line arguments when enabled | Which executable started, and what arguments did it receive? | Two audit-policy settings are required for command-line data |
| Sysmon Event ID 1 | Process creation, full command line, hashes, Process GUID, and parent-process context | What execution chain created this process, and how can the process be correlated? | Sysmon must be installed, running, and configured |
| PowerShell Event ID 4104 | PowerShell script-block content processed by the engine | What script did PowerShell process? | PowerShell Script Block Logging must be enabled |
| Windows Event Forwarding | Selected events forwarded from endpoints to a collector | How can event data be stored and analyzed centrally? | WEF forwards existing events; it does not generate missing telemetry |
Windows event channels and providers, rather than Event Viewer alone, determine how event data is generated and stored. Event Viewer is primarily an interface for consuming events; audit policies, event providers, ETW, channels, and the Event Log service determine what is available.
How do you enable command-line auditing for Event 4688?
Enable both required policies on the computers that need process command-line auditing. The first policy creates process-creation audit events; the second adds the command-line field to those events.
- Enable Audit Process Creation. Open Group Policy or the applicable local security policy and go to Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration → System Audit Policies → Detailed Tracking. Enable Audit Process Creation, normally for successful events.
- Enable Include command line in process creation events. Go to Computer Configuration → Administrative Templates → System → Audit Process Creation and enable Include command line in process creation events.
- Apply the effective policy. In a managed environment, confirm that the computer receives the intended domain policy. For testing,
gpupdate /forcecan request an immediate Group Policy refresh. - Generate a test process. Start a harmless command such as
notepad.exeorcmd.exe /c echo audit-test. - Query Security Event ID 4688. Confirm that the event exists and that the Process Command Line field contains the executable and arguments.
Microsoft documents that Include command line in process creation events is disabled or not configured by default. If the setting is not enabled, the Process Command Line field in Event 4688 is empty even when the Security log exists. See Microsoft’s documentation for command-line process auditing and the Event 4688 field definitions.
What does Event 4688 contain?
Event 4688 identifies a newly created process and includes information about the new process and its creator, including the new process ID and creator process name. When command-line auditing is active, the command-line field contains the executable and the arguments passed to it. The event is useful for investigating execution, but it is not a keystroke recorder and does not guarantee recovery of every command typed into Command Prompt.
When should you use Sysmon instead of Event 4688?
Use Sysmon when process-creation auditing needs richer correlation and execution context than the native Security event provides. Sysmon Event ID 1 records a full command line together with process identity, parent-process information, hashes, and a Process GUID, making it useful for threat hunting and execution-chain analysis.
Sysmon is a Microsoft Sysinternals service, and modern installations write events to Applications and Services Logs/Microsoft/Windows/Sysmon/Operational. Microsoft’s Sysmon event documentation describes the available event data, while its guidance on reading and tuning Sysmon events explains why configuration needs ongoing adjustment.
| Decision | Event 4688 | Sysmon Event ID 1 |
|---|---|---|
| Installation | Native Windows auditing | Requires Sysmon installation and service configuration |
| Command line | Available when the separate inclusion policy is enabled | Full command line is part of process-create telemetry |
| Process relationship | Creator information is available | Richer parent-process context and Process GUID correlation |
| Additional context | Primarily process-creation audit data | Can include hashes and other configured telemetry, such as network, file, registry, and process-termination events |
| Operational trade-off | Uses native audit and Security-log controls | More visibility, but potentially more volume and configuration noise |
Sysmon records telemetry; Sysmon does not automatically determine that a command line is malicious. Detection depends on the configuration, collection pipeline, correlation rules, and analyst interpretation. For example, an unusual parent-child relationship or an interpreter launched with unexpected arguments may deserve investigation, but one event alone is not proof of compromise.
What is the difference between Event 4688 and PowerShell Event 4104?
Event 4688 records that a PowerShell process started and the arguments supplied to the process, whereas Event 4104 records the PowerShell script-block content processed inside PowerShell. The two sources are complementary, not interchangeable.
Also popular on Amazon
- NOTEBOOK JOURNAL - This journal is made of high-density hard paper, durable and water-resistant, smooth to much. The size of this notebook is 5.3" x 8.26", lightweight and portable. The classic design style makes the notebook never goes out of fashion.
- PRACTICAL DESIGN - Bookmark helps quickly find the correct page; Elastic closure helps keep notebook securely closed; Inner pocket and pen holder provide more convenient for carrying small items. This lined journal is an amazing choice for organizing your life.
- LAY-FLAT 180° DESIGN - This classic lined notebook is designed to lay flat, which makes you easy to write and take notes efficiently. And firm thread-bound ensures pages don't get peeled away from the cover. This notebook provide you a high quality writing experience.
- PREMIUM THICK PAPER - 120 gsm lined paper, our notebook journal is made of high quality acid free paper to help prevent from damages of light and airs to keep notes on the pages clearly. There are 128 pages/64 sheets in this ruled journal, which provide you with plenty space for planning or scheduling.
- IDEAL GIFT - It is perfect for schools, business places, offices, work, home and traveling. It can be used as personal writing diary for men and women. A special gift you can share with friends and family.
PowerShell Script Block Logging can record functions, commands, and scripts processed by the PowerShell engine, whether they were invoked interactively or through automation. In Windows PowerShell 5.1, the relevant channel is Microsoft-Windows-PowerShell/Operational, and Event ID 4104 represents script-block logging. PowerShell 7 can use its corresponding PowerShell logging configuration and channel, so query the channel appropriate to the installed edition.
Microsoft separates Script Block Logging from module logging and transcription. These mechanisms record different kinds of information and can produce different volumes of data. Microsoft’s PowerShell logging guidance also discusses Protected Event Logging, which is suitable for scenarios where script-block content should be collected while the private key remains in a more secure location.
| Question | Most relevant source | What may be missing |
|---|---|---|
| Was an interpreter or shell launched? | 4688 or Sysmon Event 1 | The commands subsequently processed inside the interpreter |
| What arguments were passed when the process started? | 4688 or Sysmon Event 1 | Later commands issued by the already-running process |
| What script block did PowerShell process? | PowerShell Event 4104 | Events from periods when Script Block Logging was disabled or not retained |
| What did a PowerShell session display or record interactively? | PowerShell transcription, where configured | Content outside the configured transcription scope |
How do you read command-line events with PowerShell?
Use Get-WinEvent to retrieve local or remote Windows events, archived .evtx files, and supported ETW log files. The cmdlet can filter by log name and event ID, and it supports hashtable, XPath, and XML queries. Some logs require administrative access.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches# List logs that contain events
Get-WinEvent -ListLog * | Where-Object RecordCount
# Read the 50 most recent Security process-creation events
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} -MaxEvents 50
# Read the 50 most recent PowerShell script-block events
Get-WinEvent -FilterHashtable @{
LogName='Microsoft-Windows-PowerShell/Operational'
Id=4104
} -MaxEvents 50
# Read an archived event file
Get-WinEvent -Path 'C:EvidenceSecurity.evtx'These commands show retrieval patterns, not guaranteed output. The available fields and event volume depend on effective policy, provider installation, log retention, permissions, and whether the relevant channel is enabled. For repeatable analysis, preserve structured PowerShell objects or event XML instead of reducing everything to rendered text.
How do you query and export events with wevtutil?
wevtutil is Windows’ native command-line event utility. It can enumerate logs and publishers, query events, inspect log status, export logs to .evtx, archive logs, and clear logs. Microsoft documents the command syntax in the wevtutil reference.
wevtutil qe Security /q:"*[System[(EventID=4688)]]" /c:20 /rd:true /f:text
wevtutil epl Security C:EvidenceSecurity.evtxThe first command displays 20 matching Security events in reverse chronological order. The second exports the Security log to an evidence file. Export logs before clearing them, restrict access to the exported files, record who handled the files, and preserve the original event data when an investigation or legal process requires a defensible chain of custody.
Use structured XML or PowerShell objects rather than text parsing when events will feed detection or investigation tools. Test XPath and provider-specific queries against the target Windows version before deploying them widely. The Get-WinEvent reference covers filtering, remote queries, archived files, and access considerations.
How does Windows Event Forwarding centralize command-line logs?
Windows Event Forwarding (WEF) forwards selected events from source computers to a Windows Event Collector, where administrators can store and analyze the events centrally. WEF supports source-initiated and collector-initiated subscription models, but WEF is passive with respect to event generation.
Also popular on Amazon
- Small Notebook Set: Each piece contains 3 pocket notebooks and 3 black pens. The small notebook features PU leather cover and double-stitched binding for durability and resistance to cracking. There's a "date/page/weather/week" column on the top of every page. Pertect for women & men writing work travel note-taking dairy.
- Premium Thick Paper: The small lined notebook is made of 100gsm ivory thick paper, the paper is smooth, the writing is smooth, and the ink will not bleed. Each small note book has 136 pages (68 sheets), 3 pack together have 408 pages, ruled paper.
- Functional Design Features: Small Notebook with Elastic Holder Loop, double stitching will not fall off; Elastic Closure to back cover keeps small journal closed; Two bookmark ribbons can mark the position of your writing.
- Compact and Portable: This 3.7" x 5.7" A6 mini notebook can be used as a notepad, travel notebook, small daily journal, password book, diary, etc. It can be easily put into a pocket or wallet, allowing you to write and record anytime, anywhere.
- Perfect Gift : These beautifully pocket notebooks come in lovely gift boxes and are perfect as gifts for Christmas, Thanksgiving, birthdays, Valentine's Day, Mother's Day, Father's Day, Children's Day, and back to school for men, women, teenagers, moms, dads, girls, boys, friends, colleagues, bosses, students, teachers, family members, etc.
That means the deployment order matters:
- Enable and verify endpoint audit policies and provider configurations for Event 4688, Sysmon, or PowerShell logging.
- Configure appropriate local log sizes and overwrite behavior.
- Create WEF subscriptions for the required channels and event IDs.
- Control access to the collector and the forwarded event data.
- Monitor forwarding health, source connectivity, event volume, and retention.
- Send suitable data to a centralized Windows log analysis or SIEM platform if the organization needs correlation, alerting, dashboards, and longer-term investigation workflows.
A WEF subscription cannot recover a command-line field that the endpoint never generated. Local event logs also act as a client-side buffer when connectivity to the collector is interrupted. If a local log overwrites old events before forwarding resumes, the central collection will contain gaps. Microsoft explains these limitations in its guidance for using WEF for intrusion detection and the Windows Event Collector documentation.
What should an enterprise collection plan include?
- Policy baseline: Define which computers must generate 4688, Sysmon, and PowerShell events.
- Capacity: Size endpoint logs, collector storage, subscriptions, and downstream analysis for the expected event volume.
- Permissions: Limit access to Security, Sysmon, PowerShell, and forwarded logs.
- Retention: Set retention according to investigation, compliance, and privacy requirements rather than relying on indefinite local storage.
- Time: Maintain time synchronization and document how timestamps are interpreted during investigations.
- Tuning: Reduce unnecessary Sysmon and forwarded events while retaining the process, parent, command-line, and script data needed for detection.
- Evidence: Export and preserve original event files for investigations instead of relying only on screenshots or copied text.
Are command-line event logs safe to enable?
Command-line event logs are valuable but not risk-free. Process arguments can contain passwords, access tokens, personal information, file contents, encoded data, and other secrets. Microsoft specifically warns that anyone able to read the Security log can read command-line arguments captured by Event 4688.
PowerShell script-block logging can expose sensitive script content in the same way. Do not place secrets in command-line arguments when a safer mechanism is available. Restrict read permissions, protect exported files, limit retention, tune collection, and evaluate Protected Event Logging for PowerShell scenarios that require detailed script visibility.
Recommended Free Tools
Logging also has operational costs. Sysmon and PowerShell logging can generate substantial data depending on configuration and workload. A useful configuration records information that supports a defined detection or investigation goal; indiscriminately collecting every available channel can increase storage requirements, analyst noise, and the number of sensitive records that need protection.
Why is the Event 4688 command line blank?
A blank Event 4688 command-line field usually means the command-line inclusion policy is not enabled at the effective policy level, although missing retention, a different telemetry source, or an incomplete record can also explain the absence.
- Confirm that Audit Process Creation is enabled.
- Confirm that Include command line in process creation events is enabled under Administrative Templates → System → Audit Process Creation.
- Check the effective domain or local policy rather than assuming that a configured but overridden policy applies.
- Generate a new test process after policy refresh. Older 4688 events cannot gain command-line data retroactively.
- Check whether the Security log overwrote the relevant event or whether collection began after the process ran.
- Verify that the record is actually Event 4688 and not a different provider’s process event.
A blank field does not prove that no command ran. It may prove only that the applicable field was not generated, was not retained, or is being viewed in a source that does not provide it.
Why are Sysmon events missing?
Missing Sysmon Event ID 1 records usually indicate that Sysmon is not installed, the service is not running, the configuration does not include the event, or the expected Operational channel is not being queried.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall- Verify that Sysmon is installed and its service is running.
- Check
Applications and Services Logs/Microsoft/Windows/Sysmon/Operational. - Review the active Sysmon configuration and confirm that process creation is included.
- Check the channel’s permissions, size, retention, and overwrite behavior.
- Confirm that the query uses the correct event provider and event ID.
Why are PowerShell 4104 events missing?
Missing PowerShell Event ID 4104 records usually mean Script Block Logging is disabled, the query targets the wrong PowerShell channel, or the events were not retained. Confirm the policy configuration and distinguish Windows PowerShell 5.1 from PowerShell 7 when selecting the channel.
Also popular on Amazon
- 【All-in-One Set for Writing】This notebook and pen set combines a A5 faux leather journal with a matching pen. Perfect as a journal set, journaling set, journal and pen set – all with a built-in pen holder that keeps your tool secure.
- 【Secure Pen Holder Design】This journal with pen holder keeps your pen always attached. The integrated loop turns this notebook with pen into a reliable everyday carry. It’s also a journal with pen that looks professional on any desk, from meetings to coffee shops.
- 【Premium Paper for Your Journal】Open this journal and enjoy 160 pages of smooth, 100gsm thick ruled paper. The journal pen glides without bleed-through. Use it as a notebook and pen combo for work or personal writing.
- 【Thoughtfully Designed for Daily Use】The A5 size fits most bags. An elastic closure secures pages, two ribbon bookmarks mark your place, and an expandable back pocket stores receipts or cards. Whether you need a journal with pen for reflections or a notebook with pen holder for meetings, this design delivers.
- 【Versatile & Gift-Ready】This notebook and pen set is also a journaling set – perfect for work notes, personal journaling, or gifting. Great for professionals, students, artists, and travelers.
Also remember that Event 4104 records script-block content processed by PowerShell; it is not a universal record of every keystroke or every command typed into every shell. Event 4688 can show that powershell.exe started and the arguments it received, but only PowerShell-specific logging can provide the relevant script-block content when configured.
What should you check when Windows Event Forwarding is incomplete?
Check the endpoint’s local event generation before troubleshooting the forwarding subscription. If the source computer is not producing Event 4688, Sysmon Event 1, or PowerShell Event 4104 locally, the collector cannot receive that event.
- Verify that the endpoint generates the required event locally.
- Inspect the WEF subscription and confirm that the source computer is included.
- Check collector connectivity, authentication, and event-channel permissions.
- Check local log capacity and overwrite behavior on source computers.
- Check collector capacity, subscription scope, and destination-log retention.
- Compare event timestamps and confirm that endpoint clocks are synchronized.
- Test with a newly generated process or script block rather than relying only on an old event.
Which logging combination should you choose?
The right combination depends on whether the goal is basic process auditing, richer threat hunting, PowerShell visibility, or centralized investigation.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Goal | Recommended starting point | Why | Main caution |
|---|---|---|---|
| Basic native process auditing | Event 4688 plus both required policies | Uses built-in Windows auditing and records process arguments | Arguments may contain secrets and the Security log needs appropriate retention |
| Execution-chain analysis | Sysmon Event 1, tuned to the environment | Adds parent context, hashes, and Process GUID correlation | Configuration and event volume require active tuning |
| PowerShell investigation | Event 4688 plus Script Block Logging Event 4104 | Combines process launch details with script-block content | Script content may contain sensitive information |
| Enterprise monitoring | Endpoint logging plus WEF and centralized analysis | Supports centralized retention, correlation, and investigation | Forwarding cannot recover events not generated or retained at the endpoint |
For most Windows security baselines, start with Event 4688 and validate the two policy settings. Add Sysmon when parent-process, hash, and GUID correlation materially improves detection. Add PowerShell Script Block Logging when the investigation requires the content processed by PowerShell, and centralize only the events that the organization can protect, retain, and analyze responsibly.
Frequently Asked Questions
Does a Windows command line event log record every command typed?
No. Windows command-line logging records process launches or processed script blocks when the relevant policies are enabled; it is not a guaranteed keystroke recorder. Event 4688 can show that a shell started and the arguments it received, while PowerShell 4104 can record script-block content processed by PowerShell.
Why is the command line blank in Windows Event ID 4688?
A blank Event 4688 command-line field most often means Include command line in process creation events is not enabled at the effective policy level. Also check Audit Process Creation, log retention, the event source, and whether the process ran before the policy was applied.
Can Windows Event Forwarding create missing command-line events?
Windows Event Forwarding cannot recover command-line data that an endpoint never generated. Enable and verify endpoint audit or provider policies first, then configure WEF subscriptions, collector capacity, permissions, and retention.
What is the difference between Event 4688, Sysmon Event 1, and PowerShell Event 4104?
Event 4688 records process creation and can include launch arguments. Sysmon Event ID 1 adds richer process context such as parent-process information, hashes, and a Process GUID. PowerShell Event 4104 records PowerShell script-block content, which is different from the command line used to start PowerShell.
The Bottom Line
The most accurate meaning of “Command Line Event Log” is a group of Windows telemetry sources, not one universal log. Start with Security Event 4688 and enable both process auditing policies, add Sysmon Event 1 for richer process context, use PowerShell Event 4104 for script content, and use WEF only after endpoint generation is verified. Treat every command-line and script record as potentially sensitive evidence.
