I am needing to monitor a process on a windows server based on a particular user that is running the process.
example: dllhost.exe is typically ran by SYSTEM, but I need to monitor the dllhost.exe that is ran by a service account.
Currently there are at least 2 dllhost.exe processes running, 1 by SYSTEM and 1 by the service account. I am unable to tell the monitor which one I want to monitor.
I can see in SAM where I can create a template to monitor the process, but am not able to distinguish the user running it.