I select everything from the win32_ProcessStartTrace WMI class, and I limit the results to processes that are named Notepad.exe. In addition, I will use the Get-EventSubscriber cmdlet to verify that the event was created properly, and I will use Remove-Event and Unregister-Event to perform cleanup.

Open the Windows PowerShell console with elevated rights.

Here are the steps I will take to permit me to monitor for the startup of a specific process: Note For more information about WMI event monitoring, see An Insider’s Guide to Using WMI Events and PowerShell.

Because I am using the Win32_ProcessStartTrace WMI class, this will be really easy. To do this, I will use the Windows Management Instrumentation Query Language (WQL). Today I want to use a query to modify the behavior of Register-CimIndicationEvent. And in a modern operating system like Windows 8.1, there are all kinds of processes that start and stop all the time. It worked well-maybe a bit too well because it triggers an event for every new process that starts. In yesterday’s post, Use PowerShell to Monitor for Process Startup, I talked about using the Register-CimIndicationEvent cmdlet to monitor for process startup. If the squirrels don’t gather enough supplies for a long winter, they will be out scampering in the snow and risk untoward dangers.Īnd so it is with our computer systems-they demand monitoring, planning, and preparation for contingencies. If I don’t roll up hoses and bring them into the garage, pipes could freeze. If I don’t clean the leaf troughs in the early autumn, winter rains and subsequent freezing could spell disaster for the roof. And yet they demand a certain amount of preparation. Who knows, it may become really hot and humid over the weekend, but today I can delude myself into hearing the rustling of leaves, imagine cool breezes blowing across the yard, and think of squirrels as they quickly gather supplies for a long winter.Īll of these things are really quite simple, routine, and ordinary.

This morning it is beginning to look like autumn. Microsoft Scripting Guy, Ed Wilson, is here.

Summary : Microsoft Scripting Guy, Ed Wilson, talks about using Windows PowerShell to monitor for the creation of specific processes.

Windows monitor process