You are using an unsupported browser. Please update your browser to the latest version on or before July 31, 2020.
close
You are viewing the article in preview mode. It is not live at the moment.
Home > 330: Least Privilege Manager > Knowledge Base > 09: Eventing > 03: Does PolicyPak log sub-processes when launched from within CMD or Powershell ?
03: Does PolicyPak log sub-processes when launched from within CMD or Powershell ?
print icon

Yes, in this example below, an elevated command prompt (perhaps elevated by Self Elevate)… you can see the command “net stop spooler” logged in the event log as seen here.

TIP: If you are not seeing this be sure to upgrade to latest CSE.

Note that internal commands like: DIR or SET won’t be logged; the command must be an external command.

Feedback
0 out of 0 found this helpful

scroll to top icon