how to get all the users processes in WMI

Question

i want to get all the user's process as stated in the task manager process's (system, administrator, network service and local service).

i need to get it through the WMI, i couldn't find the username of each process and i have checked the wmi process and task manager process, the wmi shows only the administrator process alone.

can you help me to get the all user's process list???

Answer 1

you can browse Win32_Process class to get process details:

using System;
using System.Management;
using System.Windows.Forms;

namespace WMISample
{
    public class MyWMIQuery
    {
        public static void Main()
        {
            try
            {
                ManagementObjectSearcher searcher = 
                    new ManagementObjectSearcher("root\\CIMV2", 
                    "SELECT * FROM Win32_Process"); 

                foreach (ManagementObject queryObj in searcher.Get())
                {
                    Console.WriteLine("-----------------------------------");
                    Console.WriteLine("Win32_Process instance");
                    Console.WriteLine("-----------------------------------");
                    Console.WriteLine("Caption: {0}", queryObj["Caption"]);
                }
            }
            catch (ManagementException e)
            {
                MessageBox.Show("An error occurred while querying for WMI data: " + e.Message);
            }
        }
    }
}

or in the c#, without using WMI :

Process[] processlist = Process.GetProcesses();
foreach(Process theprocess in processlist)
  {
    Console.WriteLine(“Process: {0} ID: {1}”, theprocess.ProcessName, theprocess.Id);
  }

Answer 2

Maybe it is a bit late but I think it is possible using WMI through GetOwner() method of the Win32_Process class which retrieves the user name and domain (Below code is not mine, I have extracted it from http://social.msdn.microsoft.com/Forums/en-US/d842c407-18f5-478b-8c4f-7e14ac4fbbe6/get-owner-of-curently-runing-procesess ):

using System;
using System.Diagnostics;
using System.Management;   // Add reference to System.Management!!

class Program {
  static void Main(string[] args) {
    ManagementObjectSearcher searcher =
         new ManagementObjectSearcher("root\\CIMV2",
         "SELECT * FROM Win32_Process");

    foreach (ManagementObject queryObj in searcher.Get()) {
      ManagementBaseObject outParams =
         queryObj.InvokeMethod("GetOwner", null, null);
      Console.WriteLine("{0} owned by {1}\\{2}", queryObj["Name"],
        outParams["Domain"], outParams["User"]);
    }
    Console.ReadLine();
  }
}

Also If you are interested in you can do it with vbscript using below code to determine the account name under which a process is running (see below page for more detailed info http://msdn.microsoft.com/en-us/library/aa394599(v=vs.85).aspx ):

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" _
    & strComputer & "\root\cimv2")
Set colProcessList = objWMIService.ExecQuery _
    ("Select * from Win32_Process")
For Each objProcess in colProcessList
    colProperties = objProcess.GetOwner( _
        strNameOfUser,strUserDomain)
    Wscript.Echo "Process " & objProcess.Name _
        & " is owned by " _ 
        & strUserDomain & "\" & strNameOfUser & "."
Next

Hope it helps!