1

I have tried How to start a program when another one is started and this works perfectly. But how about the other way around? I would like to run a .bat when chrome is closed. By "is closed" I mean... I start chrome and when I close it I want something to happen.

Process termination stands for event with ID 4689

So I have tried:

<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">
     *[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and Task = 13312 and (band(Keywords,9007199254740992)) and (EventID=4689)]] 
   and 
     *[EventData[Data[@Name='NewProcessName'] and (Data='PATH TO CHROME')]]
    </Select>
  </Query>
</QueryList>

But it didnt work at all... task did not show any new log when I closed chrome.

Is there something im missing?

By default the part with Task = 13312 using Process Terimation was Task = 13313, however I have tried it with both 13312 and 13313 and doesnt seem to work.

UPDATE 1: Chrome was not the best "example" to pick and try this with task scheduler. I also tried different programs that do not have any background processing after beeng closed, like Notepad, Minesweeper etc... neither of those seem to trigger the task.

Improve this question
6
  • What do you want the .bat to do? Perhaps we could tackle your goal head-on rather than enabling you to beat around the bush.
    – codaamok
    Commented Oct 5, 2016 at 11:27
  • @adampski to get it straight, I want DB (MariaDB) with Apache to shutdown once I close my IDE (netbeans) the bat just contains this:"sc stop Apache sc stop MyDB".
    – Alpha2k
    Commented Oct 5, 2016 at 11:41
  • Could be chrome is running background processes, which can be found in the menu -> settings -> advanced settings -> sytem -> "continue running background apps when google chrome is closed". Just a heads up in case this could potentially keep chrome running after you close it.
    – Mr. Hargrove
    Commented Oct 5, 2016 at 11:45
  • How does Chrome have anything to do with this then? Or is it just an example process you're using?
    – codaamok
    Commented Oct 5, 2016 at 11:56
  • @adampski it's just an example, have tried notepad and some other program that don't have any background processing but they neither work, maybe chrome isn't the best example...
    – Alpha2k
    Commented Oct 5, 2016 at 12:00

2 Answers 2

Reset to default
1

Instead of using @Name='NewProcessName', you need to use @Name='ProcessName'. And use Task = 13313 (as you mentioned yourself). Then everything works as expected. Check this.

Improve this answer
0

There are two process termination of the audit success - one is at the start of the application, and second at the closing of the application. You need to add "and (Data='0x0')" as one of the argument because we want to look at the 2nd audit success process termination. Note here that the event that we're looking at is not the application process termination, but the audit success process termination.

<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">
     *[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and Task = 13313 and (band(Keywords,9007199254740992)) and (EventID=4689)]] 
   and 
     *[EventData[(Data='C:\Program Files\Genshin Impact\launcher.exe') and (Data='0x0')]]
    </Select>
  </Query>
</QueryList>

Copy paste the code above and change the directory to the application that you want to be the trigger when you close it (the EventData[(Data='PATH HERE').

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .