How do I listen/identify when a program runs in Windows using C++?

Question

Specifically, I want to listen to when programs are run and record information such as: timestamp, executable, windows name and user.

Answer 1

Look into using the Perfmon API's (check MSDN for references).

Answer 2

Alternatively, use the WMI interface to find out what's running and take appropriate action. In the VBScript code below the WMI subsystem is being queried with Select * from Win32_Process so as to change the process priority. Find out what other attributes are available for Win32_Process and you should find stuff that's heading in the direction you want to go.

Const NORMAL_PRIORITY = 32
Const LOW_PRIORITY = 64
Const REALTIME_PRIORITY = 128
Const HIGH_PRIORITY = 256
Const BELOWNORMAL_PRIORITY = 16384
Const ABOVENORMAL_PRIORITY = 32768

Function SetPriority( sProcess, nPriority )
    Dim sComputer
    Dim oWMIService
    Dim cProcesses
    Dim oProcess
    Dim bDone

    bDone = False
    sComputer = "."
    Set oWMIService = GetObject("winmgmts:\\" & sComputer & "\root\cimv2")

    Set cProcesses = oWMIService.ExecQuery ("Select * from Win32_Process Where Name = '" & sProcess & "'")
    For Each oProcess in cProcesses
        oProcess.SetPriority( nPriority )
        bDone = True        
    Next
    SetPriority = bDone
End Function

Answer 3

The most obscene way of doing this is the Google-desktop way
Namely to have your DLL load into every process that is ever started and to log information.
If you're interested more, install google desktop and watch its dll load into your processes. Then look in the registry to see it does it.
Be mindful that this is entering to the realm of virus like behaviour.

Answer 4

I would use the PSAPI function EnumProcesses() to periodically get a list of running processes.

Answer 5

You could set up a WMI permanent event subscription to monitor process creation and log the details. I have some samples here - one of the samples monitors notepad.exe creation and logs the events in a txt file. Permanent event subscription monitors events 'at all times', but if you want to monitor events 'for the duration of your application', you can use WMI COM API with C++ - the WQL event query is the same in both cases. The documentation is here.