

Or, if possible, remotely browse to the file using the C$ share in explorer and copy it to your workstation via File Explorer.We will now need to remotely collect the file C:\Windows\procmon.pmb (This is where Process Monitor is storing the events since boot) from the VDA to a remote workstation You can use PowerShell on your workstation to do this Once machine is available, log in and wait for the issue to reproduce.Select the “OK” button to close the program. Process Monitor is configured to log activity during the next boot.

A dialog box will appear stating “Process Monitor is configured to log activity during the next boot”.Now go in to the “Options” menu and select “Enable Boot Logging”.The Capture icon will now have a red X over it, meaning that the program is no longer capturing events.Click on the “Capture” icon to stop the capture process.Navigate to the folder that ProcessMonitor.zip was extracted to (e.g.Login using an account with administrative privilege (Administrator is recommended).Enable Boot Logging in Process Monitor in the PVS VDisk.
