I did not know about this until today. Pretty great addition to the Windows auditing lineup.
https://dirteam.com/sander/2015/02/17/security-thoughts-include-command-line-in-process-creation-events/ Win 8.1, Server 2012 R2 (and presumably 10) already have the kb3004375 bits baked in. Enjoy!
