Here are some easy steps for starting, stopping, and saving a Procmon capture. Microsoft’s Process Monitor (ProcMon) is an indispensable tool that a lot of Security Admin’s and IT Admin’s are using and/or have used.

System Center Endpoint Protection (SCEP) (AV, EPP) for these OS’es: Windows 10, version 1607 (Redstone 1, RS1, Anniversary update, build 14393).Windows 10, version 1703 (Redstone 2, RS2, Creators update, build 15063).Windows 10, version 1709 (Redstone 3, RS3, Fall Creators update, build 16299).Microsoft Defender Antivirus (MDAV formerly known as Windows Defender Antivirus (WDAV)) (AV, EPP) for these OS’es: I grant you a nonexclusive, royalty-free right to use & modify my sample code & to reproduce & distribute the object code form of the sample code, provided that you agree: (i) to not use my name, my companies name, logo, or trademarks to market your software product in which the sample code is embedded (ii) to include a valid copyright notice on your software product in which the sample code is embedded and (iii) to indemnify, hold harmless, and defend me, Microsoft & our suppliers from & against any claims or lawsuits, including attorneys’ fees, that arise or result from the use or distribution of the sample code. They are provided ‘as is’ without warranty of any kind, expressed or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose. If I post any code, scripts or demos, they are provided for the purpose of illustration & are not intended to be used in a production environment. All posts are provided “AS IS” with no warranties & confers no rights. Disclaimer: The views expressed in my posts on this site are mine & mine alone & don’t necessarily reflect the views of Microsoft.

Windows 2008 process monitor