Design question

[Nikolay Petrov]

We run Windows 2000 Terminal Services.
I am using Interopt on Terminal Services APIs to find which user, which
process uses.
We have two lists of applications, one list contains applications which
every user should have started no more then n times. The other contains
apps that only one of them should be run.
I need to write a Windows service which on given short intervals of
time (max 5 seconds) should check processes on the server if they obey
this rules:
1. Each user should be checked if he runs more then one app from the
second list.
2. Each user should be checked if he runs no more then n times of
each application in the first list.

I wonder how to design my app. My greates problem is the perfromance.
The whole checkup routine should be run in relative short intervals of
time, and should not be hard on the CPU of the server.

Currently I've designed a simple class which contanis information for
the user and which apps it runs.
On specified interval a check is run, which fills an arraylist of this
class for every user on the server.
I wonder how to check every class in the array agains the both rules.
And do it in less cpu intensive way.