using the NTreskit tool tlist.exe

tlist kix32 | find /i "cmd"

will display the following.

quote:

---

U:\>tlist kix32.exe | find /i "cmdline"
CmdLine: C:\WINNT\SYSTEM32\KIX32.EXE \\OSHPDC\NETLOGON\logon.bat\..\logon.KIX
CmdLine: kix32 test

---

I had placed a get $nul into my logon script to hold it open, the logon script is the first line.

while the logon script was on hold, i ran another local copy of the logon script, the local script is the 2nd line.

I can make this work.... but i was really wanting to use ptree's COM to query a remote computer....

I will keep looking.

Bryce