diff --git a/WELA.ps1 b/WELA.ps1
index eee6958d..a00371bf 100644
--- a/WELA.ps1
+++ b/WELA.ps1
@@ -361,7 +361,7 @@ function AuditLogSetting {
     )
 
     #### Process Creation
-    $guid    = "0CCE9248-69AE-11D9-BED3-505054503030"
+    $guid    = "0CCE922B-69AE-11D9-BED3-505054503030"
     $eids     = @()
     $channels = @("sec")
     $enabled  = $enabledguid -contains $guid