Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colMonitoredProcesses = objWMIService. _ ExecNotificationQuery("select * from __instanceCreationEvent " _ & " within 1 where TargetInstance isa 'Win32_Process'") i = 0
Do While i = 0 Set objProcess = colMonitoredProcesses.NextEvent If InStr(objProcess.TargetInstance.CommandLine, ".cmd") Or _ InStr(objProcess.TargetInstance.CommandLine, ".bat") Then Wscript.Echo "Batch file: " & objProcess.TargetInstance.CommandLine Wscript.Echo "Process ID: " & objProcess.TargetInstance.ProcessID End If Loop