Accessing task manager on remote Windows client

[appex32]

I hope I'm not putting something up here again that shouldn't be, Categorized Questions and Answers said to post here. Sorry again if this shouldnt be here.

Does anyone know a way in which to access the task manager of another computer (obviously under windows) and see what programs are running, if that is at all possible.

Also, is there a log that keeps track of what programs, and files, have been opened and at what time?

Thanks

20030812 Edit by jeffa: Changed title from 'networking '

[BrowserUk]

Take a look at Win32::Process::Info. The WMI varient can do this, but needs to run on a version of the OS that supports WMI, which includes 2K/ME/XP etc. but not NT4.

As for tracking programs and files, this may be possible if journaling has been enabled, which again requires NTFS 5, on the target machines, but I'm not sure if that information would be available remotely. Even if it is, I am not aware of any perl modules available for gaining access to such information.

---

Examine what is said, not who speaks.
"Efficiency is intelligent laziness." -David Dunham
"When I'm working on a problem, I never think about beauty. I think only how to solve the problem. But when I have finished, if the solution is not beautiful, I know it is wrong." -Richard Buckminster Fuller
If I understand your problem, I can solve it! Of course, the same can be said for you.

[monktim]

Here is a good site for free Windows and Linux utilities. PSTools contains what you need, a command called pslist.

http://www.systernals.com/

[NetWallah]

As previously indicated, pslist will get you a task list on a remote computer.

To answer your next question, auditing file/program access, you will need to use the "Local Security Policy" in "Administrative Tools" (Win 2K and above), go to "Local Policies -> Audit Policy , and set "Audit Object Access" appropriately.

From the help text there:
Audit object accessComputer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy
Description
Determines whether to audit the event of a user accessing an object—for example, a file, folder, registry key, printer, and so forth—that has its own system access control list (SACL) specified....
Success audits generate an audit entry when a system event is executed ...

These audit events usually show up in the event log.

Disclaimer: I have not tried this out, so If it does not work, call Bill G...

[waswas-fng]

You also may want to expand your event log size limits if you do this on a busy server. They can tend to grow very quickly.

-Waswas

[swkronenfeld]

Edited out in better conscience.