[RESOLVED] How to get process information

[Capp]

Hey guys...me again

I am using the following to check for running processes on remote machines:

Function IsProcessRunning( strServer, strProcess )
    Dim Process, strObject
    IsProcessRunning = False
    strObject   = "winmgmts://" & strServer
    For Each Process in GetObject( strObject ).InstancesOf( "win32_process" )
    If UCase( Process.name ) = UCase( strProcess ) Then
            IsProcessRunning = True
            Exit Function
        End If
    Next
End Function

It works with no problems.

What I want to know is how to get more information besides just the name of the process.

How do I find out the user that is running the processes on the remote machine?
I've tried using Process.User, Process.UserID, Process.UserName, etc.. and can't get anything.

I appreciate the help

[RobDog888]

You can use "Process.ProcessId" to get its process id.

[Capp]

Thanks,
Wouldn't that just give me this though: (PID)

[RobDog888]

Yes.

[Capp]

Yes.

Well, thanks..but I don't need the Process ID. I need to find out the username of the person running the process

[RobDog888]

Ok, I thought you were just asking for any other info you could get out of it.

Let me see what else I can find on those.

[Capp]

Thanks RobDog...I appreciate it

[RobDog888]

Ok, here we go. This will enumerate the running processes (local or remote) and identify the account that its running under/

Option Explicit
 
Private Sub Form_Load()
    Dim strComputer As String
    Dim sReturn As String
    Dim strNameOfUser As Variant
    Dim colProcesses As Object
    Dim objProcess As Object
    strComputer = "." '"." local or "\\ComputerName"
    Set colProcesses = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2").ExecQuery("Select * from Win32_Process")
    For Each objProcess In colProcesses
        sReturn = objProcess.GetOwner(strNameOfUser)
        If sReturn <> 0 Then
            MsgBox "Could not get owner info for process " & objProcess.Name & vbNewLine & "Error = " & sReturn
        Else
            MsgBox "Process " & objProcess.Name & " is owned by " & "\" & strNameOfUser & "."
        End If
    Next
End Sub

[Capp]

I'll give that a shot tonight and see how it works.

Thanks for such a quick reply. I knew there was a reason I keep coming here

[RobDog888]

I thought members hung out here for the the atmosphere?

It works great on my system (XP) and I just tested it (from XP system) to retrieve info from my 2003 Server and it works great I think I did a good job (pats self on back ).

[Capp]

I thought members hung out here for the the atmosphere?

It works great on my system (XP) and I just tested it (from XP system) to retrieve info from my 2003 Server and it works great I think I did a good job (pats self on back ).

Yes, you do a great job

I ran into a problem. The problem is, I can't get it to work using what you posted, but I have been working on this program for several months and have this function heavily built into it:

Function IsProcessRunning( strServer, strProcess )
    Dim Process, strObject
    IsProcessRunning = False
    strObject   = "winmgmts://" & strServer
    For Each Process in GetObject( strObject ).InstancesOf( "win32_process" )
    If UCase( Process.name ) = UCase( strProcess ) Then
            IsProcessRunning = True
            Exit Function
        End If
    Next
End Function

Can you show me how to get the user name information using this? Same concept, but I tried with the Process.GetOwner() as you mentioned, but on every machine, it only brought back a "0". I can get the info via command prompt so I know I have rights to it (plus I'm the local/network admin)

Like I said, this function is heavily built into what I've already done so I want to use it if possible without having to rewrite the whole program. Maybe even help me modify it a little without totally changing it.

My program looks for a list or running processes like this:

Public Sub CheckRunning()
    On Error GoTo errhand
    Dim strComputer, strProcess
    lstPrograms.Clear
    strComputer = lstComputers.Text
        strProcess = "notepad.exe"
    If (IsProcessRunning(strComputer, strProcess) = True) Then
        lstPrograms.AddItem "Notepad" & " " & "is running"
    Else
        lstPrograms.AddItem "Notepad" & " " & "is Not running"
    End If
'snip a large number of repetitive lines here

Can you help

Thanks

[Capp]

Hey RobDog888

Where'd ya go? I haven't figured this out yet

[RobDog888]

I was working on my block walls around my backyard.

I'll look at your code and see whats happening.

[RobDog888]

Ok, I incorporated my previous example into yours.

Option Explicit
 
Function IsProcessRunning(strServer, strProcess)
    Dim strNameOfUser As Variant
    Dim Process, strObject
    IsProcessRunning = False
    strObject = "winmgmts://" & strServer
    strNameOfUser = strServer
    For Each Process In GetObject(strObject).InstancesOf("win32_process")
        If UCase(Process.Name) = UCase(strProcess) Then
            Process.GetOwner (strNameOfUser)
            MsgBox strNameOfUser
            IsProcessRunning = True
            Exit Function
        End If
    Next
End Function
 
Private Sub Form_Load()
    IsProcessRunning "MyServer", "System"
End Sub

[Capp]

Ok, I incorporated my previous example into yours.

Option Explicit
 
Function IsProcessRunning(strServer, strProcess)
    Dim strNameOfUser As Variant
    Dim Process, strObject
    IsProcessRunning = False
    strObject = "winmgmts://" & strServer
    strNameOfUser = strServer
    For Each Process In GetObject(strObject).InstancesOf("win32_process")
        If UCase(Process.Name) = UCase(strProcess) Then
            Process.GetOwner (strNameOfUser)
            MsgBox strNameOfUser
            IsProcessRunning = True
            Exit Function
        End If
    Next
End Function
 
Private Sub Form_Load()
    IsProcessRunning "MyServer", "System"
End Sub

Tried it, still getting nothing. I have tried it on XP Pro and XP home.

any ideas?

[Capp]

Tried it, still getting nothing. I have tried it on XP Pro and XP home.

any ideas?

I got it...

Function IsProcessRunning(strServer, strProcess)
    Dim strNameOfUser As String 'changed it to string to display text
    Dim Process, strObject
    IsProcessRunning = False
    strObject = "winmgmts://" & strServer
    strNameOfUser = strServer
    For Each Process In GetObject(strObject).InstancesOf("win32_process")
        If UCase(Process.Name) = UCase(strProcess) Then
            Call Process.GetOwner (strNameOfUser) 'called function
            MsgBox strNameOfUser
            IsProcessRunning = True
            Exit Function
        End If
    Next
End Function

[hiren_v11]

RobDog can u help me in making AntiKeyLogger in VB,VB.net