Set dateTime = CreateObject("WbemScripting.SWbemDateTime") strComputer = "." Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2") Set colMonitorProcess = objWMIService.ExecNotificationQuery _ ("SELECT * FROM __InstanceOperationEvent " _ & " WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'")