I was thinking more of using LEM to look at user auditing on a target machine and correlate a user logged on event with the process running/exceeding CPU. It may be something SolarWinds could add, and I wouldn't think it's something WMI couldn't do, I just think they'd have to expand further how WMI captures the data.
↧