Debugging Tools for Windows: gflags.exe Silent process exit

Question

I want to monitor silent process exit issue.

I performed the steps from this blog:

http://blogs.technet.com/b/askperf/archive/2013/05/01/what-killed-my-process.aspx

But it doesnt show any event in the eventlog.

I have Windows 7 SP1 x64. Downloaded the Windows 8.1 version of the debug tools, but dont know which architecture I need: x64 because I run 64-bit Windows 7, or x86 because the app I want to silent-exit-monitor is a 32-bit application?

Anyway, as a test I created a rule for notepad.exe using 64-bit GFLAGS.EXE. I am member of local administrator group using my AD account, but I am not domain admin. The registry keys both created under Image File Execution and SilentProcessExit, I even allowed SelfExit notifications. Still I dont see anything in the application log at all!

I have no idea what went wrong. Do I need debug program privileges from GPO, or what?

Answer 1

Hello Richard,

Thank you for posting your question on Microsoft community forum.

I am sorry for late response.

The issue will be better suited for the IT professionals audience on the TechNet forums.

I would recommend posting your query in the TechNet Forums.

TechNet Forum

http://social.technet.microsoft.com/Forums/en-US/home?category=w7itpro

Thank you

Answer 2

Any idea?

Answer 3

From my another different-domain-member win7x64sp1 machine it works as well. Thatswhy I need to understand what special requirement is not met or what GPO restriction is actually prohibit this on the other domain machine.

Answer 4

I have no idea what went wrong. Do I need debug program privileges from GPO, or what?

I had no problem running the tool on a stand-alone 64-bit machine, using notepad.exe as a monitored process and taskkill.exe to terminate it. In your case I would test gflags.exe on a stand-alone machine too so that you are not affected by domain policies.