0

Is there a way that WMI can catch events, for example selecting or accessing the control panel, and processes, for example running "command".

I am a beginner on the subject of ManagementEventWatcher and I was wondering if I can catch the moment the event and the processes started. I would like to log it or put the activities inside a simple list box so I can monitor the start of the events and processes of a 2000 and XP Windows OS.

gibz357
  • 235
  • 1
  • 7
  • 20

1 Answers1

0

You could try to use the Win32_ProcessStartTrace and the Win32_ProcessStopTrace classes. I have used the StopTrace class to catch when a process that I start on a remote host finishes running.

http://msdn.microsoft.com/en-us/library/aa394374(v=vs.85).aspx

cmcginty
  • 235
  • 1
  • 3
  • 9