Hey all... Long time no post ;\)

This thread came in very handy for a project of mine at work. Basically, the next step in monitoring app licenses, is to track app usage...

 Code:
$FilterList = '\windows\','iexplore.exe'

$objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2")
$colMonitored  = $objWMIService.ExecNotificationQuery("select * from __instancecreationevent within 1 where TargetInstance isa 'Win32_Process'")

While 1
	$NextProcess = $colMonitored.NextEvent
	$Filtered = 0
	$Name = $NextProcess.TargetInstance.Name
	$Path = $NextProcess.TargetInstance.executablepath
	$User = $NextProcess.TargetInstance.ExecMethod_("GetOwner").User

	If not $user = 'SYSTEM' and not instr($user,'SERVICE')
		For each $Filter in $filterList
			if instr($Path,$filter)
				$Filtered = 1
			EndIf
		Next
		If not $Filtered
			$OldDate1 = ReadProfileString('%windir%\ProcList.ini',$Path,'Date')
			if not @oldDate1 = @date	; Only log once per day and keep the last 3 usages
				$oldTime1 = ReadProfileString('%windir%\ProcList.ini',$Path,'Time')
				$oldDate2 = ReadProfileString('%windir%\ProcList.ini',$Path,'oldDate1')
				$oldTime2 = ReadProfileString('%windir%\ProcList.ini',$Path,'oldTime1')

				$nul = WriteProfileString('%windir%\ProcList.ini',$Path,'Name',$Name)
				$nul = WriteProfileString('%windir%\ProcList.ini',$Path,'User',$User)
				$nul = WriteProfileString('%windir%\ProcList.ini',$Path,'Date',@date)
				$nul = WriteProfileString('%windir%\ProcList.ini',$Path,'Time',@time)
				$nul = WriteProfileString('%windir%\ProcList.ini',$Path,'oldDate1',$OldDate1)
				$nul = WriteProfileString('%windir%\ProcList.ini',$Path,'oldTime1',$oldTime1)
				$nul = WriteProfileString('%windir%\ProcList.ini',$Path,'oldDate2',$OldDate2)
				$nul = WriteProfileString('%windir%\ProcList.ini',$Path,'oldTime2',$oldTime2)
			endif
		EndIf
	EndIf
Loop
_________________________
How to ask questions the smart way <-----------> Before you ask