WMI monitor remote computer's process

最新推荐文章于 2025-12-05 12:03:11 发布

原创最新推荐文章于 2025-12-05 12:03:11 发布 · 1.1k 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#user #c

操作系统专栏收录该内容

12 篇文章

订阅专栏

本文介绍了一个使用VBS脚本监控指定计算机上新建进程的方法。通过传递目标计算机地址、用户名、密码及日志文件路径作为参数，此脚本能够持续监测新建进程并将相关信息记录到指定的日志文件中。

'save this script as monitor.vbs and run it like CSCRIPT monitor.vbs 192.168.1.2 user password C:\1.txt

'also you can run CSCRIPT monitor.vbs for help

Set colArgs = WScript.Arguments
If WScript.arguments.count < 3 then
WScript.Echo "USAGE:" & vbCrLf & " Monitor Computer User Password files"
WScript.quit
End If
strComputer = wscript.arguments(0)
strUser = wscript.arguments(1)
strPwd = wscript.arguments(2)
strFile = wscript.arguments(3)

set olct=createobject("wbemscripting.swbemlocator")
set wbemServices=olct.connectserver(strComputer,"root\cimv2",strUser,strPwd)
Set colMonitoredProcesses = wbemServices. _
ExecNotificationQuery("select * from __instancecreationevent " _
& " within 1 where TargetInstance isa 'Win32_Process'")

i = 0
Do While i = 0
Set objLatestProcess = colMonitoredProcesses.NextEvent
Wscript.Echo now & " " & objLatestProcess.TargetInstance.CommandLine
Set objFS = CreateObject("Scripting.FileSystemObject")
Set objNewFile = objFS.OpenTextFile(strFile,8,true)
objNewFile.WriteLine Now() & " " & objLatestProcess.TargetInstance.CommandLine
objNewFile.Close
Loop