Hiya, i got a process that I'm trying to monitor but I want to only monitor the process with the username System.
I've tried the tasklist command and wmic process but i've come up dry.
Has anyone done this before?
Thanks
un hide the command line column/filter in the task manager to see what shows. If you have a full path you should be able to use that.
If you have other flags set for process start then set a query in the command line.
ex : select ProcessId,Name,PageFileUsage from Win32_Process where ((Name = 'netsrv.exe' AND CommandLine LIKE '%c:\\windows\\system32%'))
** Note that Double Backslash \\ on the drive letter **
the command line i needed was a little complex so it was all included '%process.exe -config x:\<path-toconfig-file>%'
so with the query you can open up more than just the full path, if you have processes that run more than once, and need to monitor each instance.
Shout out to lukas.belza for highlighting this in previous posts!
