Microsoft Windows 10 Security Technical Implementation Guide

The Microsoft Windows 10 Security Technical Implementation Guide (V3 R6) has 267 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

267STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V3 · R6

CurrentPublished Mon Jan 05 2026

Windows 10 must have command line process auditing events enabled for failures.

Microsoft Windows 10 Security Technical Implementation Guide

Assessment Title

Rule Text

Windows 10 must have command line process auditing events enabled for failures.

Description

Discussion Text

When this policy setting is enabled, the operating system generates audit events when a process fails to start and the name of the program or user that created it.

These audit events can assist in understanding how a computer is being used and tracking user activity.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-257589

Rule

SV-257589r958412_rule

Severity

medium

Rule Version

WN10-AU-000585

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Ensure Audit Process Creation auditing has been enabled: 

Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >>System Audit Policies >> Detailed Tracking >> Audit Process Creation". 

If "Audit Process Creation" is not set to "Failure", this is a finding.

Implementation Procedure

Fix Text

Go to Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >>System Audit Policies >> Detailed Tracking >> Audit Process Creation is set to "failure".

STIG check 255 of 267 in the Microsoft Windows 10 STIG checklist

← Previous · V-256894Internet Explorer must be disabled for Windows 10.Next · V-257593 →Windows 10 must not have portproxy enabled or in use.