The function below uses the Win32_Process WMI class to enumerate processes running on a server that are named the same as the process name you give it. It then outputs the name of the user running the process.

Below is the function… Enjoy!

 Function FindProcessOwner( StrComputer1, ProcessName)

Dim objWMIService, colItems, objItem, Username, Domain

On Error Resume Next
‘ error control block
Set objWMIService = GetObject(“winmgmts:{impersonationLevel=impersonate}//” & strComputer1 & “\root\cimv2″)
If Err.Number <> 0 Then
WScript.Echo “An Error Occured (” & StrComputer1 & “): ” & Err.Description
End If
Set colItems = objWMIService.ExecQuery (“Select * from Win32_Process Where Name = ‘” & ProcessName & “‘”)
WScript.Echo “Searching for processes on ” & StrComputer1 & “.”
WScript.Echo colItems.count & ” processes found.”
For Each objItem in colItems
objItem.getowner Username, Domain
FindProcessOwner = FindProcessOwner & VbCrLf & strComputer1 & “: ” & objItem.name &_
“(PID: ” & objItem.processid & “) the owner is: ” & Domain & “\” & Username
Next
On Error GoTo 0
End Function

 The tool itself is an awesome resource, similar to EventID.net– except it’s FREE and it comes from Microsoft themselves providing links to Microosft content about the event entry or error message.

 You can search for any combination of the following:

Microsoft Product|
Version
Message ID
Event Source
File Name
Language

When you do it takes you to a search result page that lists the available results for your specific search, each seem to have not only an example of the message, but also an explanation of what the event means…. and the best part a section entitled User Action that gives a possible solution for the problem!

 Enjoy the tip!