

Or, if possible, remotely browse to the file using the C$ share in explorer and copy it to your workstation via File Explorer.We will now need to remotely collect the file C:\Windows\procmon.pmb (This is where Process Monitor is storing the events since boot) from the VDA to a remote workstation You can use PowerShell on your workstation to do this


