I was going back and forth with ChatGPT on creating a script that would launch procmon.exe silently via the task scheduler so I could monitor excel.exe when it saved any file ending in .csv, .xls or .xlsx. This went on for several hours, but I was not making any progress, even switching over to using Sysmon to see if I can have it do the logging I needed. Pro tip: if you have Sysmon running on a system, Procmon will be unable to load its driver and therefore will not work. You have to uninstall Sysmon first, then Procmon will work.
Procmon would start, I could see it in the task manager, but it wasn’t creating a PML file and I couldn’t terminate procmon with procmon.exe /terminate. I decided to go over to Gemini and chat back and forth with it and wasn’t making any progress there either. On a whim, I took the script that ChatGPT created and fed it into Grok.com. Grok starting churning away, checking the Internet for command line options and what did it find? ChatGPT hallucinated 2 of the command line options!
What was happening is that procmon was displaying an error, but since it was running under the SYSTEM account with /QUIET, there is no GUI to present to the user. Procmon was running in an errant state, but I couldn’t tell that. As soon as I removed the two invalid command line options, everything was right as rain.
The script ChatGPT created is too cool not to share, so here it is: https://github.com/adamleinss/PowerShellMisc/blob/master/procmon_task_scheduler.ps1. Along with this script, I uploaded the PMC file you can import into Procmon. The important bit is to make sure “Drop filter events” is checked under Filter so the PML file doesn’t increase in size unnecessarily.
-Soli Deo Gloria