How to start a program when another one is stopped
I have tried How to start a program when another one is started and this works perfectly. But how about the other way around? I would like to run a .bat when chrome is closed. By "is closed" I mean... I start chrome and when I close it I want something to happen.
Process termination
stands for event with ID 4689
So I have tried:
<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">
*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and Task = 13312 and (band(Keywords,9007199254740992)) and (EventID=4689)]]
and
*[EventData[Data[@Name='NewProcessName'] and (Data='PATH TO CHROME')]]
</Select>
</Query>
</QueryList>
But it didnt work at all... task did not show any new log when I closed chrome.
Is there something im missing?
By default the part with Task = 13312
using Process Terimation
was Task = 13313
, however I have tried it with both 13312
and 13313
and doesnt seem to work.
UPDATE 1: Chrome was not the best "example" to pick and try this with task scheduler. I also tried different programs that do not have any background processing after beeng closed, like Notepad, Minesweeper etc... neither of those seem to trigger the task.
Solution 1:
Instead of using @Name='NewProcessName'
, you need to use @Name='ProcessName'
. And use Task = 13313
(as you mentioned yourself). Then everything works as expected. Check this.