Log all process starts and terminations?

  • Thread starter Thread starter Bert Hyman
  • Start date Start date
B

Bert Hyman

Is there a utility or technique I can use which will log the starting
and termination of every process, from boot to shutdown, or as close
to each as possible?

Maybe a policy setting that will put something in one of the event
logs?
 
(e-mail address removed) (Mark L. Ferguson) wrote in
Scripting the WMI is possible. Here's a demo.
run this with:
...
Click to expand...

Thanks; that looks like a good place to start.

Still, I was hoping there was something I could just use or turn on
without actually doing any work of my own :-)
 
Even looking into the options available in "Performance Logging" would be
work.
start/run, type:
HH mk:@MSITStore:%windir%\Help\howto.chm::/snap_sysmon.htm

As far as 'built in, ready to use' stuff, task manager is about it.
 
in message
Is there a utility or technique I can use which will log the starting
and termination of every process, from boot to shutdown, or as close
to each as possible?

Maybe a policy setting that will put something in one of the event
logs?
Click to expand...


For local policy settings, run:

secpol.msc

Under Local Settings -> Audit Policy, enable success and failure
audition for process tracking, and maybe system events, too. I haven't
used these but perhaps they put into the Event Viewer logs what you
want.
 
In "Vanguard"
in message



For local policy settings, run:

secpol.msc

Under Local Settings -> Audit Policy, enable success and failure
audition for process tracking, and maybe system events, too. I
haven't used these but perhaps they put into the Event Viewer logs
what you want.
Click to expand...

Thanks; the process tracking puts just what I want into the Security
event log.

I had written a little VBScript using the WMI calls mentioned in the
other posts, but it gets shut down at some random point during Windows
shutdown, so I'm not seeing everything I wanted to see.

I don't know at what point these log entries stop being made either, so
maybe it won't be any better, but at least I don't need my own
application running.
 
Back
Top