2

Windows 8.1

I have an end user system that requires certain software/processes to start in a specific order upon logging in. These processes aren't managed services so I can't set an extended delay for the one I want to run last. I suspect that things aren't actually starting in the correct order but I'm not sure how i can confirm.

So my question is: are there Windows audit logs or tools that can tell me when exactly a given process was launched in relation to other processes?

Mike B
  • 11,871
  • 42
  • 107
  • 168

1 Answers1

2

Yes. Process Monitor and Process Explorer from Microsoft Sysinternals will give you a "Life Time" for each process, which tracks when a process was started relative to other processes, so you can see which processes were just started versus ones that have been running for a long time.

Process Monitor

Without using any external tools, you can also simply enable Process Tracking Auditing with Group Policy (or secpol.msc/Local Security Policy.) And it will log to the Security event log any time a process is launched or exited on the entire system.

Process Tracking

If the process in question is wrapped inside of an svchost.exe service hosting process, however, it's a little trickier. You would need to figure out which instance of svchost.exe hosts the process, then split the service out into individual processes by using sc config servicename Type= own as seen here and here.

Ryan Ries
  • 55,481
  • 10
  • 142
  • 199
  • Thank you, that's exactly what I needed to know. For others who may be wondering - the columns for `Process Timeline` / `Start Time` in process explorer are not enabled by default and can be added via View -> Select Columns -> Process Performance (tab). – Mike B Oct 09 '14 at 19:41