Finding all programs that were opened

[akhileshbc]

Hi guys...

My brother uses my computer for several hours. His explanation is that, he is studying (my parents had bought a Computer Based Tutorial for his studies: LearnNext)...! So, I want to check whether he is really studying or not. I can't keep an eye on him, every time. So, I decided to track his usage. And wrote a program to find the total time that he uses the computer(that program is working perfect).

My question is, how can I trace all the programs that he had opened. I want only the title name of the program(and I will store it to a Log File for evaluating it at the end of the day). I want it to be executed each and every minute, when he uses the computer.

Any ideas...???

Thanks for reading...

[si_the_geek]

Rather than detect all programs, I would recommend just checking the one that is currently being used.

To do that you can use the GetForeGroundWindow API (which returns the hWnd of the window that has focus):

Private Declare Function GetForegroundWindow Lib "user32" () As Long

...and GetWindowText should give you the title:

Private Declare Function GetWindowText Lib "user32" Alias "GetWindowTextA" (ByVal hwnd As Long, ByVal lpString As String, ByVal cch As Long) As Long

This is untested, but might work:

Dim lnghWnd as Long
Dim strText As String
  lnghWnd = GetForeGroundWindow 
  strText = String(500, Chr$(0))
  GetWindowText lnghWnd, strText, 500
  MsgBox strText

[Siddharth Rout]

Have you tried Filemon?

Alternatively you can also do it this way...

Windows XP includes several auditing options which can provide a list of activities you can view in the event viewer.

To turn on process tracking:

* Click on Start, and then Run.
* Enter "gpedit.msc" and press OK. This starts the group policy editor.
* Expand Computer Configuration, Windows Settings (by clicking on the boxed plus sign to its left.
* Expand Security Settings, then Local Policies and then click on Audit Policy.
* Double click on Audit process tracking.
* Check the box labeled Success for Audit these attempts.
* OK your way back out.

Now leave the computer as it is. Now whatever processes will run be be tracked. To see all you need to do is click on menu Start~~> Run and type "eventvwr" and then press enter. Click on the Security item, and the right hand pane will contain a list of events, most recent first. There you double click on one and the details, including the name of the executable, will be displayed. There you have your list.

Remember to turn process tracking off when you're done by unchecking the Success checkbox.

Hope this helps...

Edit: I am assuming that you have administrative rights on that pc...

[akhileshbc]

Rather than detect all programs, I would recommend just checking the one that is currently being used.

To do that you can use the GetForeGroundWindow API (which returns the hWnd of the window that has focus):

Private Declare Function GetForegroundWindow Lib "user32" () As Long

...and GetWindowText should give you the title:

Private Declare Function GetWindowText Lib "user32" Alias "GetWindowTextA" (ByVal hwnd As Long, ByVal lpString As String, ByVal cch As Long) As Long

This is untested, but might work:

Dim lnghWnd as Long
Dim strText As String
  lnghWnd = GetForeGroundWindow 
  strText = String(500, Chr$(0))
  GetWindowText lnghWnd, strText, 500
  MsgBox strText

Thanks si..
But it only gives the title of the active program...! So, I need to use a Timer for finding the active window's title...right..??? Will it affect the other programs...??? Because, he may( I think ) be running some Games (FULL SCREEN) also...!

Have you tried Filemon?

Alternatively you can also do it this way...

Windows XP includes several auditing options which can provide a list of activities you can view in the event viewer.

To turn on process tracking:

* Click on Start, and then Run.
* Enter "gpedit.msc" and press OK. This starts the group policy editor.
* Expand Computer Configuration, Windows Settings (by clicking on the boxed plus sign to its left.
* Expand Security Settings, then Local Policies and then click on Audit Policy.
* Double click on Audit process tracking.
* Check the box labeled Success for Audit these attempts.
* OK your way back out.

Now leave the computer as it is. Now whatever processes will run be be tracked. To see all you need to do is click on menu Start~~> Run and type "eventvwr" and then press enter. Click on the Security item, and the right hand pane will contain a list of events, most recent first. There you double click on one and the details, including the name of the executable, will be displayed. There you have your list.

Remember to turn process tracking off when you're done by unchecking the Success checkbox.

Hope this helps...

Edit: I am assuming that you have administrative rights on that pc...

Thanks sid... The security audit is what I was looking for. But how can I code it using VB6 (so that I can customize it, ie. including some filters, etc.)

[si_the_geek]

Thanks si..
But it only gives the title of the active program...!

Indeed, and that may be enough for you - as you will know what is actually being used, rather than just what is loaded but minimised etc.

So, I need to use a Timer for finding the active window's title...right..???

Yes.

Will it affect the other programs...??? Because, he may( I think ) be running some Games (FULL SCREEN) also...!

I haven't tried it, but I think that full-screen games usually have a window title too.



However, I think the security audit is probably the best idea, as it is more reliable (my method depends on the timer interval and other things).

[akhileshbc]

Thanks si...

Is there any way to communicate to the security audit program, through my VB6 app..?? Because, the details of the program executed (which is visible in the event viewer), needs to be customized.

For example, I want to list all the programs in a Listview, search for a specific program, etc...

[Siddharth Rout]

Here is a quick example to handle gpedit from vb6. I cannot post a complete example as I am in the office and I don't have access to gpedit.msc.

Also see this link on how to work with WScript.Shell in vb6

http://technet.microsoft.com/en-us/l.../cc181231.aspx

Private Sub Command1_Click()
    Dim wsh

    Set wsh = CreateObject("WScript.Shell")

    '~~> Launch gpedit.msc
    wsh.Run "gpedit.msc"

    '~~> Wait 1/2 a Second
    WScript.Sleep 500

    '~~> Activate the Group Policy Window
    ret = wsh.AppActivate("Group Policy")

    '~~> Wait 1/2 a Second
    WScript.Sleep 500
End Sub

[akhileshbc]

Thanks sid..

I will try that....

[akhileshbc]

Now I need assistance on another problem. How can I prevent using the computer after 10pm.(means at night).?

[westconn1]

how do you stop him disabling your attempts?
you could try task scheduler to shut down computer
or use a timer that after 10pm just runs some procedure (loop) to freeze the computer

[akhileshbc]

Thanks westconn1...

Is there any other way like, showing a FULL SCREEN window and displaying a message that, you are not allowed to use the computer after 10pm. I don't wan't hime to use any other programs. Just click the shutdown menu in my form. (I know how to include a button for shutdown)But I want to prevent hm from opening other programs.
(The fullscreen technique was seen in certain Websites. eg. Orkut. When I upload a new avatar, a translucent form will appear for uploading the pic and we can't click anything in the back). Is it possible...?

[si_the_geek]

I don't see any benefit of doing that rather than just shutting down turn off the computer - because it wont allow the chance to close programs, and save files etc as apt.


If you are using Windows 7 (and I think Vista too, maybe even XP if you download from MS) you can use "Parental Controls" to do this.


If not, I think this suggestion is good:

you could try task scheduler to shut down computer

..because if you simply run ShutDown.exe (or whatever it is called), there will be no time to use Task Manager to cancel it. You can also run it as a different account, so that he wont have permission to stop it even if there is time.

You should also be able to set the task for Time>10pm, so that if the computer is rebooted it will shut down again.


As programs run by Task Scheduler can't be seen on the desktop, I would recommend creating a separate program with a timer, which simply shows a warning message about 5 minutes before (so that your brother can save his work).

I would include a message to say that the computer will shut down soon, and another to say that closing this program wont stop it. To make sure it gets his attention, I would also play an annoying sound file on a loop (and flash the window in the taskbar) until a button is clicked on.

[akhileshbc]

I don't see any benefit of doing that rather than just shutting down turn off the computer - because it wont allow the chance to close programs, and save files etc as apt.


If you are using Windows 7 (and I think Vista too, maybe even XP if you download from MS) you can use "Parental Controls" to do this.


If not, I think this suggestion is good:
..because if you simply run ShutDown.exe (or whatever it is called), there will be no time to use Task Manager to cancel it. You can also run it as a different account, so that he wont have permission to stop it even if there is time.

You should also be able to set the task for Time>10pm, so that if the computer is rebooted it will shut down again.


As programs run by Task Scheduler can't be seen on the desktop, I would recommend creating a separate program with a timer, which simply shows a warning message about 5 minutes before (so that your brother can save his work).

I would include a message to say that the computer will shut down soon, and another to say that closing this program wont stop it. To make sure it gets his attention, I would also play an annoying sound file on a loop (and flash the window in the taskbar) until a button is clicked on.

Wow..! That's a good idea...! Thanks.....

[akhileshbc]

Which file should I have to include for the Scheduler...??? I didn't see a Shutdown.exe file..! I am using Win XP SP2 ...

[si_the_geek]

I don't know I'm afraid, as I've only ever used it in a quick test, and that was many years ago!

There have been many posts about it (and the VB6 equivalent code so you can make your own), so a search should get good results.

[akhileshbc]

Ok.. Thanks...