Here is a WMI Event watcher based on the __InstanceDeletionEvent
, it will tell you when the notepad.exe
is closed via wscript popup and restart itself if you name it "Notepad_Emailer.vbs"
strComputer = "."
Set objSWbemServices = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!" & "\\" & strComputer & "\root\cimv2")
Set objEventSource = objSWbemServices.ExecNotificationQuery( "SELECT * FROM __InstanceDeletionEvent " & "WITHIN 1 " & "WHERE TargetInstance " & "ISA 'Win32_Process' " & "AND TargetInstance.Name = 'notepad.exe'")
Set objEventObject = objEventSource.NextEvent()
set kdshell = createobject("WScript.Shell")
Wscript.Echo "NOTEPAD WAS CLOSED, REPLACE THIS LINE WITH YOUR EMAIL SCRIPT"
kdshell.Run "Notepad_Emailer.vbs",0,false
Combine this with your email snippet and you are all set.