This itself has two different methods that use either standard Windows Remoting (winrm), which is more efficient here, or by just remoting specific calls, which doesn’t require winrm to have been configured and working.
Use the built-in remoting capabilities of the script. Use a separate administrator session when on a multi-user operating system such as Server 2016 or 2019, e.g., when using Parallels® Remote Application Server (RAS), Citrix Virtual Apps and Desktops or VMware Horizon. There are two ways we can run the script to monitor logons: The most common use case for this script is likely seeing what processes are created, by what and with what command lines, during a user logon or potentially a logoff, if that is problematic. Process Creation Monitoring Local Logon Monitoring These actions are asynchronous, so are not suited to some needs, but can be useful to take process dumps or kill the original process and re-launch another one with a different command line or even run a completely different executable. The script can show not only what is run, almost as soon as it happens, but also has features to allow it to perform actions when specific processes, optionally matching specific command lines, are run. No elevation required (scenario dependent). No prerequisites, such as enabling process creation and command line auditing. 
Presented here is a different approach that gets Windows Management Instrumentation (WMI) notifications for new process creations via the WqlEventQuery class available in the.
Enabling process creation and termination auditing events, and then piecing together the activity by analysis of these events which are written to the security event log. Using SysInternals Process Monitor, although this can be difficult to remote to single-user operating systems like Windows 10 and can massively slow down operations because of its own large resource requirements. Traditionally, people have used a number of different methods to glean this information: 
When troubleshooting situations such as a slow or failing logon or a user failing to perform some task, it can be useful to know what processes were launched, when they were launched and what command line arguments were used.
0 kommentar(er)
