Page 1 of 1

Windows monitor Process by User

Posted: Thu Apr 26, 2018 2:04 am
by ir0nx
Hello,

is there a possibility to monitor Windows Processes by Users ?
We have a terminal server where one special process needs to be started by 4 different users (4 process instances, 4 different users).
Now I want to trigger an alert, if the process will not be started by a user or crashes in a user session.
Simply monitoring just the process-name wont work as all 4 processes are same name.
Is there a simple way for monitoring this ?

Thanks,
Regards,
ir0nx

Re: Windows monitor Process by User

Posted: Thu Apr 26, 2018 3:43 pm
by cdienger
ncpa(https://www.nagios.org/ncpa/) may be your answer. To monitor the chrome process being run by the admin user on my test machine it's just:

./check_ncpa.py -H <ip> -t '<token>' -M 'processes' -q 'username="ACME\Administrator",name=chrome.exe'