1

I would like to track number of times a particular exe is executed. WIth my research so far I didn't find much of a programatic way to get the data. I found some applications like windows prefetch which could help but in my organisation I'm not allowed to use these third party applications. Kindly help me out with a way to get the data with C# code/powershell or any simple way a windows admin know of. Appreciate it!

RMu
  • 817
  • 2
  • 17
  • 41
  • Simplest way is to rename a.exe to b.exe & make a new a.exe that logs a counter then runs b.exe. Failing that you can enable the generation of process creation audit events in the event log and grep for that. – Alex K. Mar 15 '17 at 15:44
  • @Stephan I edited the question. I meant how to get the number using any programming language. It's not executed programatically. – RMu Mar 15 '17 at 15:47
  • The simplest way is store the number of times in a Batch file: `call :getTimes` & `set /A times+=1` & `echo set "times=%times%" >> "%~F0"` & `theProgram.exe` & `goto :EOF` & `:getTimes` – Aacini Mar 15 '17 at 22:04
  • I want note that no one of the 9 answers at the "duplicate question" provides a simple and practical solution to this problem... – Aacini Mar 15 '17 at 22:14

1 Answers1

0

The only reliable way to track every single exe execution is to design an app to run in Kenrel mode..

The other not that reliable way is to periodically poll for running processes in the system, using Process.GetProcessByName method for instance.

Serge Semenov
  • 9,232
  • 3
  • 23
  • 24