win32_process

Finding the owner of a process remotely with VBScript via the Win32_process class

 Recently I had an issue where I needed to find the user running a series of processes on a large number of servers. Initially, it was a long process of logging onto each server then opening task manager and sorting by process name. After about 5 servers, I realized it was going to take hours to sort out the users running the processes… so I spent 30 minutes not preforming this process and wrote a script to do the rest of the work in less than a minute!

The function below uses the Win32_Process WMI class to enumerate processes running on a server that are named the same as the process name you give it. It then outputs the name of the user running the process.

Below is the function… Enjoy!

 Function FindProcessOwner( StrComputer1, ProcessName)

Dim objWMIService, colItems, objItem, Username, Domain

On Error Resume Next
‘ error control block
Set objWMIService = GetObject(”winmgmts:{impersonationLevel=impersonate}//” & strComputer1 & “\root\cimv2″)
If Err.Number <> 0 Then
WScript.Echo “An Error Occured (” & StrComputer1 & “): ” & Err.Description
End If
Set colItems = objWMIService.ExecQuery (”Select * from Win32_Process Where Name = ‘” & ProcessName & “‘”)
WScript.Echo “Searching for processes on ” & StrComputer1 & “.”
WScript.Echo colItems.count & ” processes found.”
For Each objItem in colItems
objItem.getowner Username, Domain
FindProcessOwner = FindProcessOwner & VbCrLf & strComputer1 & “: ” & objItem.name &_
“(PID: ” & objItem.processid & “) the owner is: ” & Domain & “\” & Username
Next
On Error GoTo 0
End Function

Using WMI’s WIN32_Process class to remotely kill a process

Recently I had a situation where I had to kill a number of processes on a number of servers in a short period of time so we could update the executable file quickly so the processes could be safely respawned. This presented a challenge because it needed to be done quickly both before users respawned the process multiple times on each server and because the number of servers involved did not lend itself to simply logging onto the server and killing the processes one server at a time.

So I pulled out the scripting hat and went to work making use of the WMI Win32_Process class to create the following function that gets passed the process name you want to kill and the remote server name where you want to kill the processes.   Worked like a champ! One hitch was that there were users still on the server, but that was solved by simply running the script multiple times while we copied the new files to the servers.

So, here is the function I spoke about… hopefully you can add it to your list of script tools in your scripting tool belt!
Function RemoteKill( StrComputer1, ProcessName)

    Dim objWMIService, colItems, objItem

    On Error Resume Next
    ‘ error control block
    Set objWMIService = GetObject(”winmgmts:{impersonationLevel=impersonate}//” &  strComputer1 & “\root\cimv2″)
    Set colItems = objWMIService.ExecQuery (”Select * from Win32_Process Where Name = ‘” & ProcessName & “‘”)
    For Each objItem in colItems
        RemoteKill = RemoteKill & VbCrLf & strComputer1 & “: “
        RemoteKill = RemoteKill & objItem.name & “(PID: ” & objItem.processid & “) Terminated.”
        ObjItem.terminate
    Next
    On Error GoTo 0
End Function