[RESOLVED] Simulate Task Manager - XP

[SuperFlee]

GOAL: Simulate Task Manager in windows xp.

Problem: Cannot determine ownership of each running process.


I can retrieve all the running processes but I cannot determine what their ownership is. Whatever is listed under "User Name" in task manager is considered the owner of the process.

Anyone that would be able to help It would be extremely appreciated.

Flee

[SuperFlee]

Anybody ??

=(

All these viewers and no reply's, not even super moderators.

perhaps someone can do it in .net or c and wrap up the function calls so we can use them in vb6.

Flee

[manavo11]

Don't know if this is what you need : http://www.vbforums.com/showpost.php...99&postcount=7

[SuperFlee]

I appreciate your help manavo11.

I am going to research GetProcessAffinity and find out what thats about.

Their has to be a way for the vb compiler to get the needed function to retrieve the username of each process running in memory..

I mean c`mon, task manager does it right?

Flee

[SuperFlee]

WOOHOO!!!

I finally Solved My problem!

This is the code that returns the ownership and other process information of all running processes in memory:

Private Sub Form_Load()
 
Dim strComputer ' As String
Dim Ret ' As Long
Dim colProcesses ' As SWbemObjectSet
Dim objProcess ' As SWbemObject
Dim strNameOfUser ' As String
strComputer = "."
 
Set colProcesses = GetObject("winmgmts:" & _
   "{impersonationLevel=impersonate}!\\" & strComputer & _
   "\root\cimv2").ExecQuery("Select * from Win32_Process")
 
For Each objProcess In colProcesses
 
    Ret = objProcess.GetOwner(strNameOfUser)
    pid = objProcess.processid
 
    If Ret <> 0 Then
        Debug.Print "Could not get owner info for process " & _
            objProcess.Name & vbNewLine _
            & "Error = " & Ret
    Else
        Debug.Print "Process " & objProcess.Name & " PID " & objProcess.processid & " is owned by " _
           & "\" & strNameOfUser & "."
            
            
    End If
Next
 
 
End Sub

This was the results:

Could not get owner info for process System Idle Process
Error = 2
Process System PID 4 is owned by \SYSTEM.
Process smss.exe PID 476 is owned by \SYSTEM.
Process csrss.exe PID 524 is owned by \SYSTEM.
Process winlogon.exe PID 548 is owned by \SYSTEM.
Process services.exe PID 592 is owned by \SYSTEM.
Process lsass.exe PID 604 is owned by \SYSTEM.
Process svchost.exe PID 764 is owned by \SYSTEM.
Process svchost.exe PID 840 is owned by \NETWORK SERVICE.
Process svchost.exe PID 904 is owned by \SYSTEM.
Process svchost.exe PID 960 is owned by \NETWORK SERVICE.
Process svchost.exe PID 1020 is owned by \LOCAL SERVICE.
Process spoolsv.exe PID 1200 is owned by \SYSTEM.
Process GBPoll.exe PID 1476 is owned by \SYSTEM.
Process inetinfo.exe PID 1508 is owned by \SYSTEM.
Process Mcshield.exe PID 1560 is owned by \SYSTEM.
Process VsTskMgr.exe PID 1616 is owned by \SYSTEM.
Process mdm.exe PID 1704 is owned by \SYSTEM.
Process nalntsrv.exe PID 1748 is owned by \SYSTEM.
Process poweroff.exe PID 1804 is owned by \SYSTEM.
Process PRISMXL.SYS PID 1932 is owned by \SYSTEM.
Process wdfmgr.exe PID 1992 is owned by \LOCAL SERVICE.
Process alg.exe PID 796 is owned by \LOCAL SERVICE.
Process hkcmd.exe PID 2188 is owned by \Administrator.
Process dpmw32.exe PID 2208 is owned by \Administrator.
Process nwtray.exe PID 2216 is owned by \Administrator.
Process Directcd.exe PID 2224 is owned by \Administrator.
Process shstat.exe PID 2308 is owned by \Administrator.
Process UpdaterUI.exe PID 2336 is owned by \Administrator.
Process TBMon.exe PID 2348 is owned by \Administrator.
Process jusched.exe PID 2368 is owned by \Administrator.
Process ctfmon.exe PID 2392 is owned by \Administrator.
Process AcroTray.exe PID 2592 is owned by \Administrator.
Process GBTray.exe PID 2640 is owned by \Administrator.
Process WBINST~1.EXE PID 3460 is owned by \Administrator.
Process explorer.exe PID 2344 is owned by \Administrator.
Process zone.exe PID 3776 is owned by \Administrator.
Process iexplore.exe PID 1124 is owned by \Administrator.
Process VB6.EXE PID 1672 is owned by \Administrator.
Process wmiprvse.exe PID 2648 is owned by \NETWORK SERVICE.

If anyone else has this issue, you now have a solution!

Flee

[SuperFlee]

UPDATE:

This is a modified version of the above code.. Its much shorter and to the point.

Dim PID As String
    Dim PROCESS As String
        Dim OWNER As Variant
        Dim objProcess As Variant
        Dim colProcesses As Variant
                      
    Set colProcesses = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2").ExecQuery("Select * from Win32_Process")
    
    For Each objProcess In colProcesses
        If objProcess.GetOwner(OWNER) = 0 Then
            PROCESS = objProcess.Name
            PID = objProcess.processid
            debug.print PID & " " & PROCESS & " " & OWNER
        End If
    Next

[Hack]

Nice job. This is worth booking marking!

[napper]

I like these and find them useful but am a little confused about the code. Where does the variable OWNER (or strNameOfUser) get set? I ran the code and it works but do not know how these are being set.

Thanks

[manavo11]

It gets set when this is executed : objProcess.GetOwner(OWNER)

[napper]

After I posted I figured as much. When I program I hardly ever send actual objects from one method to another so it didn't appear to me that that was happening at first.

I would assume it would of been better for them to have had the owner as a property and not the result of a method of the object. For example,

OWNER = objProcess.Owner
If OWNER = 0 Then
   ...
End If

[fifo]

nice, so cool