Procs_Start_and_Stop_WMI_Events_Log.vbs

REM Procs Start and Stop WMI Events Log
REM solution for http://sysadmins.ru/topic192410.html

on error resume next

set wall = new logwindow

computer = "."
set service = getobject("winmgmts:\\" & computer & "\root\CIMV2")

set processstartsink = wscript.createobject("WbemScripting.SWbemSink","processstart_")
service.execnotificationqueryasync processstartsink, "SELECT * FROM Win32_ProcessStartTrace"

set processstopsink = wscript.createobject("WbemScripting.SWbemSink","processstop_")
service.execnotificationqueryasync processstopsink, "SELECT * FROM Win32_ProcessStopTrace"

do
    wscript.sleep(1000)
loop

sub processstart_onobjectready(receivedevent, asynccontext)
    message2wall receivedevent, "Process Start"
end sub

sub processstop_onobjectready(receivedevent, asynccontext)
    message2wall receivedevent, "Process Stop"
end sub

function message2wall(receivedevent, action)
    REM uint4  PageDirectoryBase;
    REM uint32 ParentProcessID;
    REM uint32 ProcessID;
    REM string ProcessName;
    REM uint8  SECURITY_DESCRIPTOR[];
    REM uint32 SessionID;
    REM uint8  Sid[];
    REM uint8  TIME_CREATED;
    wall.write now() & " " & action
    wall.write "ProcessName: " & receivedevent.processname
    wall.write "ProcessID: " & receivedevent.processid
    wall.write "ParentProcessID: " & receivedevent.parentprocessid
    wall.write "SessionID: " & receivedevent.sessionid
    wall.write "Sid: " & join(receivedevent.sid, "; ")
    wall.write "TIME_CREATED: " & receivedevent.time_created & "<hr>"
end function

class logwindow
    private ie

    private sub class_initialize()
        set ie = wscript.createobject("InternetExplorer.Application", "ie_")
        with ie
            .menubar = false
            .toolbar = false
            .resizable = true
            .statusbar = false
            .addressbar = false
            .visible = true
            .navigate "about:blank"
            REM .FullScreen = True
            .document.write "<title>Procs Start and Stop WMI Events Log</title>"
        end with
    end sub

    public sub write(text)
        ie.document.write text & "<br>"
    end sub

end class

sub ie_onquit()
    processstartsink.cancel
    processstopsink.cancel
    wscript.quit
end sub