Powershell script to check for running process, and email if it is running

patriots used Ask the Experts™
I'd like to know of a way to script the following preferably in pshell:
1. Check for a running process.
2. If it's running, send message to SMTP address.
3. Leverage task scheduler - I know that I can do SMTP alerting in Task Manager, and I know about "Get-Process", I just don't know how to tie it all together.

Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
This is a bit rough and ready as I'm not really 100% sure what your trying to do...

The following script will check to see if notepad is running. If it is, it will fire off an email to an address.


if (Get-Process notepad) {

    # Set SMTP Server
    $smtpServer = "localhost"

    # Create new mail objects
    $msg = new-object Net.Mail.MailMessage
    $smtp = new-object Net.Mail.SmtpClient($smtpServer)
    $to = "recipient@domain.com"
    $from = "senderaddress@domain.com"
    $subject = "Subject line goes here"
    $body = "Body Text of your message goes here"

    # Create Message
    $msg.From = $from
    $msg.Subject = $subject
    $msg.Body = $body

    # Send Message


Save this as a PS1 file, the use Task Scheduler to run

powershell.exe -ExecutionPolicy ByPass -file <path_to_script>.ps1

Hope it helps, but if not, let me know and Ill see if I can help out.
I have written a function that checks to see if a process is running that accepts the name of the process as a parameter such that I can use wild cards for the test rather than asking for the process by name as if the process is not running an exception is returned (that is essentially why the if test can work).  There is a Send-MailMessage cmdlet available in PowerShell 2, however this does rely on the smtp server being on the default port.

Note: I have used the back-tick line continuation character to make to code more readable.

function Test-ProcessRunning
    $processFound = $false
    $p = Get-Process | Where-Object {$_.Name -like $ProcessName }
    if ($p -ne $null)
        $processFound = $true
      return $processFound

if (Test-ProcessRunning *note*)
    send-mailmessage -to "username@domain.com.au" `
        -from "username@domain.com.au" `
        -subject "Process Running" `
        -SmtpServer "localhost" `
Qlemo"Batchelor", Developer and EE Topic Advisor
Top Expert 2015

get-process is able to use wildcards. So if we always search with wildcards, no error condition will be met if the process does not run. Instead of using the function above, we can also call either
  get-process notepad*
  get-process notepad -ea SilentlyContinue
as condition.
OWASP: Forgery and Phishing

Learn the techniques to avoid forgery and phishing attacks and the types of attacks an application or network may face.


what about running this from a job server with a remote server as the target for the script?  Both the source and target both contain pshell v2.
Qlemo"Batchelor", Developer and EE Topic Advisor
Top Expert 2015
get-process has a -ComputerName option for that purpose. But you need to provide the details, because that is much more complex now, and it is almost a different question. Probably you have a bunch of computers you want to check against, but we only need to check a single process on each?

The serial approach, processing one PC after another, which introduces lags if PCs are not reachable (I'm using the latter shown send-mailmessage code here):
$procMask = ProcToCheck
gc c:\servers.txt | % {
  if ($proc = get-process -ComputerName $_ $procMask* -SilentlyContinue) {
    send-mailmessage -to "user@domain.com" `
        -from "user@domain.com" `
        -subject "$proc.Count process(es) matching $procMask* running on $_" `
        -SmtpServer "localhost" `

Open in new window

There are more advances methods, like using PSSessions to execute the queries in parallel for all PCs. But they need some setup effort, and are more complex to manage.
Qlemo"Batchelor", Developer and EE Topic Advisor
Top Expert 2015

Please explain why you chose http:#a37853074 and http:#37854263 as (only) answers, in particular since I have simplified/improved those, and gave additional feedback to your follow-up question.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial