If process creation audit is enabled, Windows is supposed to create an event log entry (ID: 4688) for every new process creation event. However, Windows 11 22H2 had a bug wherein the process creation audit logging didn’t work.Read more
Event ID 1108/4688 Process Creation Audit Issue Fixed in KB5020044
