Detect application close based on app user's name - powershell

Question

been trying to create script to detect user's application crash. (Assume the computer is used by multiple users)
so far only managed to come out below code to query the application (based on user name) only but not app close or crash
gwmi -query "select * from win32_process where name='calc.exe'" | %{if($_.GetOwner().User -eq 'myUser'){
#do something when app crash
}}

Answer 1

You can use the Register-WmiEvent cmdlet to register an event with the Win32_ProcessStopTrace event class.
The Win32_ProcessStopTrace doesn't have a GetOwner() method, but you can use your current code to gather the Process ID's of the processes you're interested in, and use those in your event query:
$UserName = 'myUser'
$ProcessName = 'calc.exe'
$PIDFilters = Get-WmiObject -Query "SELECT * FROM Win32_Process WHERE Name='$ProcessName'" |Where-Object {
$_.GetOwner().User -eq $UserName
} |Select-Object -ExpandProperty ProcessId |ForEach-Object {
"ProcessId={0}" -f $_
}
$WmiFilter = $PIDFilters -join " OR "
Now, you have a $WmiFilter that looks something like this:
ProcessId=2468 OR ProcessId=11576 OR ProcessId=5426
You can use that in a WMI query:
$WmiQuery = "SELECT * FROM Win32_ProcessStopTrace WHERE ($WmiFilter)"
And finally register the event with Register-WmiEvent:
Register-WmiEvent -Query $WmiQuery -SourceIdentifier CalcStopEvent -Action {
$TraceEvent = $Event.SourceEventArgs.NewEvent
if($TraceEvent.ExitStatus -ne 0){
# The process didn't exit with success/noerror
# Send many emails!
# Sound the klaxon!
# Call the fire brigade!
# or, whatever you feel like ...
}
}