how to get process list before event id 1022.

hotmail.com bangu00 166 Reputation points
2022-09-29T02:20:33.51+00:00

Hello,

Sometime, Event 1022 occurred on windows 2012 R2 system.
So, i want to find process_name of the PID in the Event to solve for the problem.
I think, i have to capture process list befor the event was occurred.
Is there way to capture process?

Thank you.

Windows Server 2012
Windows Server 2012
A Microsoft server operating system that supports enterprise-level management, data storage, applications, and communications.
1,527 questions
Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,112 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. hotmail.com bangu00 166 Reputation points
    2022-10-20T06:13:53.937+00:00

    The problem solved .
    Thank you

    0 comments