The VBScript Network and Systems Administrator's Cafe

Apr 13 2009   3:18PM GMT

Finding the owner of a process remotely with VBScript via the Win32_process class

Jerry Lees Jerry Lees Profile: Jerry Lees

 Recently I had an issue where I needed to find the user running a series of processes on a large number of servers. Initially, it was a long process of logging onto each server then opening task manager and sorting by process name. After about 5 servers, I realized it was going to take hours to sort out the users running the processes… so I spent 30 minutes not preforming this process and wrote a script to do the rest of the work in less than a minute!

The function below uses the Win32_Process WMI class to enumerate processes running on a server that are named the same as the process name you give it. It then outputs the name of the user running the process.

Below is the function… Enjoy!

 Function FindProcessOwner( StrComputer1, ProcessName)

Dim objWMIService, colItems, objItem, Username, Domain

On Error Resume Next
‘ error control block
Set objWMIService = GetObject(“winmgmts:{impersonationLevel=impersonate}//” & strComputer1 & “\root\cimv2”)
If Err.Number <> 0 Then
WScript.Echo “An Error Occured (” & StrComputer1 & “): ” & Err.Description
End If
Set colItems = objWMIService.ExecQuery (“Select * from Win32_Process Where Name = ‘” & ProcessName & “‘”)
WScript.Echo “Searching for processes on ” & StrComputer1 & “.”
WScript.Echo colItems.count & ” processes found.”
For Each objItem in colItems
objItem.getowner Username, Domain
FindProcessOwner = FindProcessOwner & VbCrLf & strComputer1 & “: ” & &_
“(PID: ” & objItem.processid & “) the owner is: ” & Domain & “\” & Username
On Error GoTo 0
End Function

 Comment on this Post

There was an error processing your information. Please try again later.
Thanks. We'll let you know when a new response is added.
Send me notifications when other members comment.

Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to:

Share this item with your network: