Yes, but you first need to install Sysmon to monitor these types of events as not all programs do this. to the least of my knowledge.
This will enable you to restart any app it collects in the
ProcessTerminate event and restart in any time after you want. You will not be limited to the 30 seconds as like using a Batch Script.
- Grab a coffee and download from the link above.
- Install with
Sysmon.exe -i in
- No need to restart.
What this does fully, is found here.
System Monitor (Sysmon) is a Windows system service and device driver that, once installed on a system, remains resident across system reboots to monitor and log system activity to the Windows event log
Now that's installed you can find it located in the
For this example, I'll use stickies and Windows 10 Pro.
N.B. Before using the code in the Task Scheduler it's best to test first in
- Right click on
Event Viewer (Local)
Create Custom View...
- Click on the
- Check the checkbox
Edit query manually
This is an example of the stickies program. Just simply modify
C:\Program Files (x86)\Stickies\stickies.exe to suit your needs. I will explain to the best of my ability below what each section does for
Example of Query:
<Query Id="0" Path="Microsoft-Windows-Sysmon/Operational">
*[EventData[Data[@Name='Image'] = 'C:\Program Files (x86)\Stickies\stickies.exe']]
[EventData[Data[@Name='Image'] = 'validFullPath.exe']] is query for the path.
What this does is a search for the location of the program files
.exe. This must be a full path as there's no way to use wildcards such as
and is the and statement to also match...
*[System[(EventID=5) is the Event ID for
(4) If done correctly, you should see the processes of that particular program in the Main GUI when it was last Terminated. If not open the app up and close it, you should see
Number of events:... New event available at the very top of Event Viewers UI, hit F5 to refresh and you should now see a new Event entry at the top, all going well.
- More detailed info can be found in the Events and Event Filtering Enteries section of the Sysmon page.
- To learn more about Event filtering please see Wikipedia on Filtering using XPath 1.0
- If you have made a mistake you will get this warning message
The Event Log query specified is invalid.
- Fret not, as it won't do any harm. Just try again.
Now that you have the query sorted.
All you have to do is set-up the Task Scheduler. See the steps below in the attached image.
Task Schedule Diagram Steps 1-8
Task Schedule Steps Diagram 1-8
FINAL NOTE, REGARDING STEP 4 OF THE DIAGRAM:
- It's important to set the delay to your requirements e.g.
2 seconds in my case.
- Then set
Repeat task... at the minimum allowed in TS, then the duration slightly longer by 2 seconds. (Test this per app).
- Don’t use
Stop all running... checkbox as this will cause a nasty stop/start loop.
It took me a while to figure this out but I'm very glad I did!, I hope you find this useful