Solved

Antonymous Process power shell script

Posted on 2015-02-18
9
87 Views
Last Modified: 2015-02-19
I've been looking for a script that can check if a certain process is running and if it's not start it back up and keep monitoring if it stops start it back up again.
0
Comment
Question by:Network Zero
  • 5
  • 3
9 Comments
 
LVL 70

Expert Comment

by:Chris Dent
ID: 40619177
All you really need is an infinite loop.
while ($true) {
  $Process = Get-Process ExeName
  if (-not $Process) {
    # Insert code to start the process here. Could be as simple as:
    Start-Process ExeName
  }
  # Sleep a little while to control the speed of the loop
  Start-Sleep -Seconds 10
}

Open in new window

Now the problem of monitoring is moved a step back, what watches the watcher?

Chris
0
 
LVL 68

Expert Comment

by:Qlemo
ID: 40619196
In fact I would use a process termination event trigger instead. But that does not change much, it would still be an "endless loop" monitoring the process.
0
 
LVL 7

Author Comment

by:Network Zero
ID: 40619269
Qlemo how it look with a process termination event trigger?
0
 
LVL 7

Author Comment

by:Network Zero
ID: 40619272
Like this?

---------

while ($true) {
  $Process = Get-Process ExeName
  if (-not $Process) {
    # Insert code to start the process here. Could be as simple as:
    Start-Process Time.exe
  }
  # Sleep a little while to control the speed of the loop
  Start-Sleep -Seconds 10
}
0
6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

 
LVL 68

Accepted Solution

by:
Qlemo earned 500 total points
ID: 40619348
No, it is much more simple. E.g. for NotePad, starting Calc (to not get into an endless loop when testing):
Register-WmiEvent -query 'select * from Win32_ProcessStopTrace where Processname=''notepad.exe''' -action { Start-Process Calc.exe }

Open in new window

Keep the PS you run that in opened, otherwise the registration will be removed again. In an all-in-one command, e.g. in Task Scheduler, you would use
PowerShell -NoExit -Command "& {Register-WmiEvent -query 'select * from Win32_ProcessStopTrace where Processname=''notepad.exe''' -action { Start-Process Calc.exe }}"

Open in new window

0
 
LVL 7

Author Comment

by:Network Zero
ID: 40619932
Qlemo when I ran

Register-WmiEvent -query 'select * from Win32_ProcessStopTrace where Processname=''notepad.exe''' -action { Start-Process Calc.exe }

Open in new window


It came up with calculators like a million times I had to shut down my computer is there any way to prevent it from opening more then once.

or will the task manager stop that. I want to run it on a server so don't want it to crash with a zillion exe's lol.
0
 
LVL 68

Expert Comment

by:Qlemo
ID: 40620074
This should only start one (!) calculator if Notepad is closed (!).
0
 
LVL 7

Author Comment

by:Network Zero
ID: 40620221
I ran the script

I had IE not running,  nothing happened

I opened IE and closed it.

And calc opened. I closed it then 3 more calcs came up

Calc
I opened and close IE again now I have 4 calculators LOL

I feel like I'm being attacked by calculators lol.. how can we keep it one calculator or one exe
Screenshot-6.png
0
 
LVL 7

Author Closing Comment

by:Network Zero
ID: 40620433
BOMB !!!  THIS WAS WHAT  I WAS LOOK FOR! I was able to take the script and make it work and I learned a bunch of stuff in the way!
0

Featured Post

Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

How to sign a powershell script so you can prevent tampering, and only allow users to run authorised Powershell scripts
This article will help you understand what HashTables are and how to use them in PowerShell.
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
This tutorial demonstrates a quick way of adding group price to multiple Magento products.

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now