CMD Command Line Logging

[splunktrainingu]

I was following this guide on adding command line logging to my GPO. I verified that the current GPO has these settings. 

1. You must enable the Audit Process Creation audit policy so that 4688 events are generated. You can enable this audit policy from the following Group Policy Object (GPO) container: Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\System Audit Policies\Detailed Tracking.
2. You must enable the Include command line in process creation events GPO setting. You can find this setting in the following GPO container: Computer Configuration\Administrative Templates\System\Audit Process Creation. Alternatively, you can enable this setting in the local system registry by setting the HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit\
   ProcessCreationIncludeCmdLine_Enabled registry key value to 1.

Here is what I did to test, I simply created a directory, deleted it, also ran ipconfig, net share and was unable to find those commands expect for ipconfig in the logs.  Is there anything else I need to do maybe in the input.conf file? 

EDIT: Seems like mkdir and rmdir do not show up in the logs but all others do. Does anyone know why?

[Emarflix]

I think it is because commands like dir, ls, cd are internal commands but commands like ping, ipconfig are external commands and they are executable files also (ping.exe, tracert.exe) and they don't create any process. so I think we can't get internal commands logs. If there are any way please let me know

[splunktrainingu]

Yeah I was confusing powershell logging with cmd. They are both turned on through the GPO but it seems like I need to go into inputs.conf for powershell logging and make a stanza.

[thambisetty · Accepted solution]

As far as I know and experienced enabling cmd line logging. You need to make changes in only group policy.

once you are done with you are good to go. You don’t need to make any changes in inputs.conf