如何监控用户正在执行的应用程序

Question

I want to create an application/service to monitor user activity, especially to log every application that user is running.
Is this possible in c#? I think not. So how to do this in c++ and winapi? I don't want whole solution because it's surely complicated. Give me an advice only.
Thanks!

Answer 1

You could write a DLL that hooks CreateProcessW. In this hook, you would (a) do what you want to do when a process is spawned, and (b) inject itself into the new process.

Then, inject the DLL into all currently running processes.

EDIT: My answer to another related question should help you.

Answer 2

Have a look here http://msdn.microsoft.com/en-us/library/1f3ys1f9.aspx

This will give you all processes running on the local computer.

To get processes that have a window do:

var procWithWindow = from proc in Process.GetProcesses()
                     where IntPtr.Zero != proc.MainWindowHandle
                     select proc;

Answer 3

Management.ManagementObjectSearcher Processes = new Management.ManagementObjectSearcher("SELECT * FROM Win32_Process");
foreach (Management.ManagementObject Process in Processes.Get())
{
    if (Process.Item("ExecutablePath") != null)
    {
        string ExecutablePath = Process.Item("ExecutablePath").ToString();
        string[] OwnerInfo = new string[2];
        Process.InvokeMethod("GetOwner", (object[])OwnerInfo);
        // do something
    }
}

The process owner will be available in the OwnerInfo string array.