{"id":54583,"date":"2009-01-19T20:57:00","date_gmt":"2009-01-19T20:57:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2009\/01\/19\/hey-scripting-guy-how-can-i-be-notified-when-a-process-begins\/"},"modified":"2009-01-19T20:57:00","modified_gmt":"2009-01-19T20:57:00","slug":"hey-scripting-guy-how-can-i-be-notified-when-a-process-begins","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/hey-scripting-guy-how-can-i-be-notified-when-a-process-begins\/","title":{"rendered":"Hey, Scripting Guy! How Can I Be Notified When a Process Begins?"},"content":{"rendered":"

\"Hey, <\/h2>\n

Hey, Scripting Guy! I need to be notified when a process begins. I would like to use Windows PowerShell to do this, but it does not seem to work. While I could do this in VBScript, I prefer to use Windows PowerShell. Can this be done?<\/p>\n

– NL<\/p>\n

\"Spacer\"\"Hey,<\/p>\n

Hi NL,<\/p>\n

Because we have access to the .NET Framework in Windows PowerShell, it can most certainly be done. In Windows PowerShell 2.0, which just released as Community Technology Preview (CTP) 3, there is actually a cmdlet that you can use. But because a CTP is not supported, you can use the .NET Framework classes today. The advantage of this approach is that it will work with both Windows PowerShell 1.0 and Windows PowerShell 2.0, when it ships with Windows 7.<\/p>\n\n<\/thead>\n\n\n
\n

This week we will be talking about WMI eventing. For some VBScript examples of these kinds of scripts, you can refer to the eventing section of the Hey, Scripting Guy! archive<\/a>. Additional information can be obtained from this Web page<\/a>. The Microsoft book, Microsoft Windows Scripting with WMI: Self-Paced Learning Edition<\/a>, has an entire chapter on WMI eventing.<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

<\/div>\n

Today’s script, MonitorForProcessStartUp.ps1<\/b>, obtains diagnostic process information when any new process starts up. Here it is:<\/p>\n

Clear-Host\n$Start = get-date\nWrite-Host \"Waiting for a new process to be created ...\nYou will be notified within 10 seconds of  process  creation\n start time was $Start\"\n$Query = \"select * from __instanceCreationEvent within 10\n          where targetInstance isa 'win32_Process'\"\n$Eventwatcher = New-Object management.managementEventWatcher $Query\n$Event = $Eventwatcher.waitForNextEvent()\n$Event.targetInstance |\nFormat-List -property [a-z]*\n<\/pre>\n
The first thing we want to do is to clear the screen. We do this so we can take a nice screen shot for today’s article, but it is also good for telling at a glance if your event has fired. As a best practice, you should actually prompt the user before clearing the screen. This is because someone could have data on the screen of their Windows PowerShell console, and become really enraged if you were to erase the screen. Personally, I have never seen that situation, but theoretically it could happen. To clear the screen you use the Clear-Host<\/b> function as seen here:<\/p>\n
Clear-Host<\/pre>\n
If you would like to prompt the user before clearing the screen, you could use this  technique:<\/p>\n
$response = Read-Host -prompt \"Would you like to clear the screen? &lt;yes&gt;&lt;no&gt;\"\nif($response -eq \"yes\") { clear-host }\n<\/pre>\n
It is time to get the time, or the entire date as is our case here. To get a time stamp, we use the Get-Date<\/b> cmdlet. The Get-Date<\/b> cmdlet returns an entire System.DateTime<\/b> object, which we store in the $Start<\/b> variable. You may not be too excited about DateTime<\/b> objects, but to me they are one of the strongest motivators for using Windows PowerShell instead of using VBScript. Why? Well, I hated date manipulation in VBScript\u2014just a pet peeve<\/a> perhaps. (Pet peeves are pretty cool. T hey do not make much noise, do not make messes, and eat very little. I have never had a pet peeve get me up in the middle of the night to take it outside either.) The members of the System.DateTime<\/b> object are seen in Table 1. <\/p>\n
Table 1 Members of the System.DateTime object<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Name<\/td>\nMember Type<\/td>\nDefinition<\/td>\n<\/tr>\n<\/thead>\n
\n
Add<\/p>\n<\/td>\n
\n
Method<\/p>\n<\/td>\n
\n
System.DateTime Add(TimeSpan value)<\/p>\n<\/td>\n<\/tr>\n
\n
AddDays<\/p>\n<\/td>\n
\n
Method<\/p>\n<\/td>\n
\n
System.DateTime AddDays(Double value)<\/p>\n<\/td>\n<\/tr>\n
\n
AddHours<\/p>\n<\/td>\n
\n
Method<\/p>\n<\/td>\n
\n
System.DateTime AddHours(Double value)<\/p>\n<\/td>\n<\/tr>\n
\n
AddMilliseconds<\/p>\n<\/td>\n
\n
Method<\/p>\n<\/td>\n
\n
System.DateTime AddMilliseconds(Double value)<\/p>\n<\/td>\n<\/tr>\n
\n
AddMinutes<\/p>\n<\/td>\n
\n
Method<\/p>\n<\/td>\n
\n
System.DateTime AddMinutes(Double value)<\/p>\n<\/td>\n<\/tr>\n
\n
AddMonths<\/p>\n<\/td>\n
\n
Method<\/p>\n<\/td>\n
\n
System.DateTime AddMonths(Int32 months)<\/p>\n<\/td>\n<\/tr>\n
\n
AddSeconds<\/p>\n<\/td>\n
\n
Method<\/p>\n<\/td>\n
\n
System.DateTime AddSeconds(Double value)<\/p>\n<\/td>\n<\/tr>\n
\n
AddTicks<\/p>\n<\/td>\n
\n
Method<\/p>\n<\/td>\n
\n
System.DateTime AddTicks(Int64 value)<\/p>\n<\/td>\n<\/tr>\n
\n
AddYears<\/p>\n<\/td>\n
\n
Method<\/p>\n<\/td>\n
\n
System.DateTime AddYears(Int32 value)<\/p>\n<\/td>\n<\/tr>\n
\n
CompareTo<\/p>\n<\/td>\n
\n
Method<\/p>\n<\/td>\n
\n
System.Int32 CompareTo(Object value), System.Int32 CompareTo(DateTime value)<\/p>\n<\/td>\n<\/tr>\n
\n
Equals<\/p>\n<\/td>\n
\n
Method<\/p>\n<\/td>\n
\n
System.Boolean Equals(Object value), System.Boolean Equals(DateTime value)<\/p>\n<\/td>\n<\/tr>\n
\n
GetDateTimeFormats<\/p>\n<\/td>\n
\n
Method<\/p>\n<\/td>\n
\n
System.String[] GetDateTimeFormats(), System.String[] GetDateTimeFormats(IFormatProvider provider), System.String[] GetDateTimeFormats(Char format), System.String[] GetDateTimeFormats(Char format, IFormatProvider provider)<\/p>\n<\/td>\n<\/tr>\n
\n
GetHashCode<\/p>\n<\/td>\n
\n
Method<\/p>\n<\/td>\n
\n
System.Int32 GetHashCode()<\/p>\n<\/td>\n<\/tr>\n
\n
GetType<\/p>\n<\/td>\n
\n
Method<\/p>\n<\/td>\n
\n
System.Type GetType()<\/p>\n<\/td>\n<\/tr>\n
\n
GetTypeCode<\/p>\n<\/td>\n
\n
Method<\/p>\n<\/td>\n
\n
System.TypeCode GetTypeCode()<\/p>\n<\/td>\n<\/tr>\n
\n
IsDaylightSavingTime<\/p>\n<\/td>\n
\n
Method<\/p>\n<\/td>\n
\n
System.Boolean IsDaylightSavingTime()<\/p>\n<\/td>\n<\/tr>\n
\n
Subtract<\/p>\n<\/td>\n
\n
Method<\/p>\n<\/td>\n
\n
System.TimeSpan Subtract(DateTime value), System.DateTime Subtract(TimeSpan value)<\/p>\n<\/td>\n<\/tr>\n
\n
ToBinary<\/p>\n<\/td>\n
\n
Method<\/p>\n<\/td>\n
\n
System.Int64 ToBinary()<\/p>\n<\/td>\n<\/tr>\n
\n
ToFileTime<\/p>\n<\/td>\n
\n
Method<\/p>\n<\/td>\n
\n
System.Int64 ToFileTime()<\/p>\n<\/td>\n<\/tr>\n
\n
ToFileTimeUtc<\/p>\n<\/td>\n
\n
Method<\/p>\n<\/td>\n
\n
System.Int64 ToFileTimeUtc()<\/p>\n<\/td>\n<\/tr>\n
\n
ToLocalTime<\/p>\n<\/td>\n
\n
Method<\/p>\n<\/td>\n
\n
System.DateTime ToLocalTime()<\/p>\n<\/td>\n<\/tr>\n
\n
ToLongDateString<\/p>\n<\/td>\n
\n
Method<\/p>\n<\/td>\n
\n
System.String ToLongDateString()<\/p>\n<\/td>\n<\/tr>\n
\n
ToLongTimeString<\/p>\n<\/td>\n
\n
Method<\/p>\n<\/td>\n
\n
System.String ToLongTimeString()<\/p>\n<\/td>\n<\/tr>\n
\n
ToOADate<\/p>\n<\/td>\n
\n
Method<\/p>\n<\/td>\n
\n
System.Double ToOADate()<\/p>\n<\/td>\n<\/tr>\n
\n
ToShortDateString<\/p>\n<\/td>\n
\n
Method<\/p>\n<\/td>\n
\n
System.String ToShortDateString()<\/p>\n<\/td>\n<\/tr>\n
\n
ToShortTimeString<\/p>\n<\/td>\n
\n
Method<\/p>\n<\/td>\n
\n
System.String ToShortTimeString()<\/p>\n<\/td>\n<\/tr>\n
\n
ToString<\/p>\n<\/td>\n
\n
Method<\/p>\n<\/td>\n
\n
System.String ToString(), System.String ToString(String format), System.String ToString(IFormatProvider provider), System.String ToString(String format, IFormatProvider provider)<\/p>\n<\/td>\n<\/tr>\n
\n
ToUniversalTime<\/p>\n<\/td>\n
\n
Method<\/p>\n<\/td>\n
\n
System.DateTime ToUniversalTime()<\/p>\n<\/td>\n<\/tr>\n
\n
DisplayHint<\/p>\n<\/td>\n
\n
NoteProperty<\/p>\n<\/td>\n
\n
Microsoft.PowerShell.Commands.DisplayHintType DisplayHint=DateTime<\/p>\n<\/td>\n<\/tr>\n
\n
Date<\/p>\n<\/td>\n
\n
Property<\/p>\n<\/td>\n
\n
System.DateTime Date {get;}<\/p>\n<\/td>\n<\/tr>\n
\n
Day<\/p>\n<\/td>\n
\n
Property<\/p>\n<\/td>\n
\n
System.Int32 Day {get;}<\/p>\n<\/td>\n<\/tr>\n
\n
DayOfWeek<\/p>\n<\/td>\n
\n
Property<\/p>\n<\/td>\n
\n
System.DayOfWeek DayOfWeek {get;}<\/p>\n<\/td>\n<\/tr>\n
\n
DayOfYear<\/p>\n<\/td>\n
\n
Property<\/p>\n<\/td>\n
\n
System.Int32 DayOfYear {get;}<\/p>\n<\/td>\n<\/tr>\n
\n
Hour<\/p>\n<\/td>\n
\n
Property<\/p>\n<\/td>\n
\n
System.Int32 Hour {get;}<\/p>\n<\/td>\n<\/tr>\n
\n
Kind<\/p>\n<\/td>\n
\n
Property<\/p>\n<\/td>\n
\n
System.DateTimeKind Kind {get;}<\/p>\n<\/td>\n<\/tr>\n
\n
Millisecond<\/p>\n<\/td>\n
\n
Property<\/p>\n<\/td>\n
\n
System.Int32 Millisecond {get;}<\/p>\n<\/td>\n<\/tr>\n
\n
Minute<\/p>\n<\/td>\n
\n
Property<\/p>\n<\/td>\n
\n
System.Int32 Minute {get;}<\/p>\n<\/td>\n<\/tr>\n
\n
Month<\/p>\n<\/td>\n
\n
Property<\/p>\n<\/td>\n
\n
System.Int32 Month {get;}<\/p>\n<\/td>\n<\/tr>\n
\n
Second<\/p>\n<\/td>\n
\n
Property<\/p>\n<\/td>\n
\n
System.Int32 Second {get;}<\/p>\n<\/td>\n<\/tr>\n
\n
Ticks<\/p>\n<\/td>\n
\n
Property<\/p>\n<\/td>\n
\n
System.Int64 Ticks {get;}<\/p>\n<\/td>\n<\/tr>\n
\n
TimeOfDay<\/p>\n<\/td>\n
\n
Property<\/p>\n<\/td>\n
\n
System.TimeSpan TimeOfDay {get;}<\/p>\n<\/td>\n<\/tr>\n
\n
Year<\/p>\n<\/td>\n
\n
Property<\/p>\n<\/td>\n
\n
System.Int32 Year {get;}<\/p>\n<\/td>\n<\/tr>\n
\n
DateTime<\/p>\n<\/td>\n
\n
ScriptProperty<\/p>\n<\/td>\n
\n
System.Object DateTime {get=if ($this.DisplayHint -ieq  Date) {\n                        {0} -f $this.ToLongDateString()\n                    }\n                    elseif ($this.DisplayHint -ieq Time)\n                    {\n                        {0} -f  $this.ToLongTimeString()\n                    }\n                    else\n                    {\n                        {0} {1} -f $this.ToLongDateString(), $this.ToLongTimeString()\n                    };}<\/pre>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
<\/div>\n
To store the start date in the $Start<\/b> variable, we use this code:<\/p>\n
$Start = get-date<\/pre>\n
We now need to prompt the user to let them know that the script is actually working. We can use the Write-Host<\/b> cmdlet to do this. We use an expanding string, which allows us to use the datetime<\/b> value stored in the $Start<\/b> variable directly. We do not need to fool with concatenation. Strings in Windows PowerShell are assumed to continue to the next line if they are not closed, and we can break our message up across three lines without needing to use line concatenation, or even embedding carriage returns and line feeds (a la vbcrlf<\/b> from VBScript fame). This is seen here: <\/p>\n
Write-Host \"Waiting for a new process to be created ...\nYou will be notified within 10 seconds of  process  creation\n start time was $Start\"\n<\/pre>\n
When the script is run, the message is printed on the screen along with the current starting time. This is shown here:<\/p>\n
\"Image<\/p>\n
 <\/p>\n
After we have prompted our user, we can create our event query. This uses the same query syntax familiar from VBScript event scripts<\/a>. This query string is seen here: <\/p>\n
$Query = \"select * from __instanceCreationEvent within 10\n          where targetInstance isa 'win32_Process'\"\n<\/pre>\n
Now we need to actually create the event watcher. To do this, we first need to create an instance of the System.Management.ManagementEventWatcher<\/b> .NET Framework class. We use the New-Object<\/b> cmdlet to do this. The class name is ManagementEventWatcher<\/b>, and the namespace the class is found in is System.Management<\/b>. Because we need to know the namespace the class resides in to be able to create an instance of the class, I make it a habit of always referring to the class by the full name. It is a bit cumbersome, but I have found it to be much more convenient than spending 15 minutes searching MSDN documentation to try to identify the namespace of a class. When we create the instance of the ManagementEventWatcher<\/b>, we give it a constructor. The constructor is used to govern the way in which the class is actually created. In this example, we are giving ManagementEventWatcher<\/b> the query stored in the $query<\/b> parameter. This is my favorite constructor for this class. Other constructors are listed on MSDN<\/a>. We store the newly minted System.Management.ManagementEventWatcher<\/b> class in the $EventWatcher<\/b> variable as seen here:<\/p>\n
$Eventwatcher = New-Object system.management.managementEventWatcher $Query<\/pre>\n
Now all we need to do is to sit and wait. We are using the WaitForNextEvent<\/b> method from the System.Management.ManagementEventWatcher<\/b> class. When the event occurs, the returned ManagementBaseObject<\/b> is stored in the $event<\/b> variable as seen here:<\/p>\n
$Event = $Eventwatcher.waitForNextEvent()<\/pre>\n
Next we use the targetInstance<\/b> property to retrieve the properties of the Win32_Process<\/b> class. We pipeline this to the Format-List<\/b> cmdlet and print out all the properties that begin with the letters a-z<\/b> and are followed by any other character. This removes the system properties that begin with the double underscore (such as __NameSpace<\/b>). This is seen here: <\/p>\n
$Event.targetInstance |\nFormat-List -property [a-z]*\n<\/pre>\n
The result is all the information normally associated with a query to the Win32_Process<\/b> WMI class. This is shown here:<\/p>\n
\"Image<\/p>\n
 <\/p>\n
Well, NL, we hope you enjoyed today’s article about monitoring for process startup. We will continue working with WMI events tomorrow. Until then, do not pick up any stray pet peeves you see wandering along the side of the road. See you tomorrow.<\/p>\n
 <\/p>\n
Ed Wilson and Craig Liebendorfer, Scripting Guys<\/b><\/p>\n","protected":false},"excerpt":{"rendered":"
Hey, Scripting Guy! I need to be notified when a process begins. I would like to use Windows PowerShell to do this, but it does not seem to work. While I could do this in VBScript, I prefer to use Windows PowerShell. Can this be done? – NL Hi NL, Because we have access to […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[42,31,87,3,4,45,6],"class_list":["post-54583","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-events-and-monitoring","tag-operating-system","tag-processes","tag-scripting-guy","tag-scripting-techniques","tag-windows-powershell","tag-wmi"],"acf":[],"blog_post_summary":"
Hey, Scripting Guy! I need to be notified when a process begins. I would like to use Windows PowerShell to do this, but it does not seem to work. While I could do this in VBScript, I prefer to use Windows PowerShell. Can this be done? – NL Hi NL, Because we have access to […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/54583","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=54583"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/54583\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=54583"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=54583"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=54583"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}