Set Monitored Programs List

Use this group policy to specify a list of programs that will generate an audit trail event when executed by users.

If you enable this policy, all users executing the listed programs will generate an audit trail event, whether they are audited or not, unless the user is specified in Set skip users for monitored program executions.

Note that all commands must be specified with full paths.

If this policy is set to Disabled or Not Configured, by default, no executed programs will generate an audit trail event for any user.

This policy modifies the event.monitor.commands parameter in the agent configuration file.