Windows is constantly starting and stopping programs as part of its normal operations. You can see exactly what programs are being run using a Windows technique called process auditing.
Programs do seem to come and go at times. When you’re diagnosing performance or security issues, understanding what’s coming and going can be important. Sometimes, it can just explain a flashing item in the task bar.
Fortunately, there is a fairly simple way to trace what’s happening.
Windows includes several auditing options, which can collect a list of activities over time. You can then view these in the Event Viewer. One of those auditing options is tracking every time that a program starts.
Now, let’s be clear about something: even on a machine that appears to be doing absolutely nothing, Windows and the applications on it may be very busy. In other words, there may be a lot of programs that are more or less constantly coming and going, starting and stopping, and just generally doing whatever it is that they do.
As a result, process tracking with the auditing tools can slow your machine down a lot. You won’t want to have it on all the time.
But it can be a very useful tool to turn on for “a while” just to see what’s happening.
Enable process auditing
To turn on process auditing, run gpedit.msc, the Group Policy Editor1. You can type that into the Run box on the Start menu of Windows versions that have it, enter it as a command in a Windows Command Prompt, or just start typing gpedit.msc at the Windows 8 Start screen and click it when it appears in the search results.
In the left pane (expanded below for readability):
- In Computer Configuration, expand Windows Settings (by clicking the triangle or boxed plus sign to its left).
- Expand Security Settings.
- Expand Local Policies.
- Click Audit Policy.
In the right pane, double-click Audit process tracking:
In the resulting dialog box, check the box labelled Success under Audit these attempts:.
Click OK and close gpedit.msc.
Run your scenario
Now, run the scenario that concerns you. If it’s a start-up issue, then reboot. Otherwise, do (or wait for) whatever it is that you’re attempting to diagnose.
Don’t be at all surprised if your machine runs slower. As I mentioned above, process tracking can absolutely have a negative impact on performance.
Examine Event Viewer logs
Now, fire up the Event Viewer (Start, Run, and eventvwr will do it. Or type eventvwr at the Windows 8 Start screen and click the icon when it appears.)
You might want to move the Event Viewer window and perhaps expand it to make the items within easier to see.
Expand the Windows Logs item in the left pane. Click Security underneath it:
In the upper center pane, you should see a number of Audit Success events with a Task Category of either Process Created or Process Terminated. Click one of those and select the Details tab in the lower center pane (here, I’ve also made the lower pane larger by dragging the divider up):
You can scroll up and down in the upper pane, watching the lower pane to see what programs have been created or terminated. Hopefully, you’ll find the answer to your question there.
Did I mention there will be lots of programs starting and stopping? This is the nature of a complex operating system like Windows and the complex applications we install. You may need to do a little research to determine what some of the applications are, but a process of elimination will hopefully let you narrow down your list of suspects quickly.
Turn it off!
Don’t forget to to turn process tracking off when you’re done. Simply repeat the process that you used to turn it on, but this time, uncheck the Success checkbox for Audit these attempts that you had checked earlier.