Process owners

[Guest]

Argh!

I'm trying to find a way to export (hopeully) or at least view the owners of processes that are running on remote PCs.

Hyena will show quite a bit of info about processes, but I can't figure out how to show the account that launched the process.

Help

[cmccullough]

Re: Process owners

I'm not sure where you would find this if it's even tracked by Windows. You might try WMI to see if you can find anything there.

[Guest]

Re: Process owners

<div class="ubbcode-block"><div class="ubbcode-header">Quote:</div><div class="ubbcode-body">Originally posted by cmccullough:
<span style="font-weight: bold">I'm not sure where you would find this if it's even tracked by Windows....</span></div></div>

Oh, it's tracked all right. Other command line and GUI tools will report this information.


<div class="ubbcode-block"><div class="ubbcode-header">Quote:</div><div class="ubbcode-body">Originally posted by cmccullough:
<span style="font-weight: bold">You might try WMI to see if you can find anything there.</span></div></div>

Ah! But therein lies the trouble. The WMI classes as accessible through Exporter Pro (and Hyena) do not offer the process owner's name/account!


Update: I've created a batch file that uses XP's tasklist command to capture and filter the processes on remote machines. The output is piped and appended to a text file. I created a tool within Hyena to launch the batch file against a number of machines at once.

I'd rather have Hyena's Exporter Pro fetch the information for me though--it would save me several extra steps!

Thanks!

[Guest]

Re: Process owners

Is this what you're looking for??

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\" & strComputer & "\root\cimv2")
Set colProcessList = objWMIService.ExecQuery _
("Select * from Win32_Process")
For Each objProcess in colProcessList
colProperties = objProcess.GetOwner(strNameOfUser,strUserDomain)
Wscript.Echo "Process " & objProcess.Name & " is owned by " _
& strUserDomain & "" & strNameOfUser & "."
Next

Hope this helps!

Joel

[kstanush]

Re: Process owners

I can add a small dialog in the next update to show the owner (through WMI), but the problem is that since its implemented through a method call, calling it on every process object will be a bit tricky. But maybe I can make it a multi-selection function and then just feed the results to the dialog.

Thanks for alerting me to this method.

[Guest]

Re: Process owners

<div class="ubbcode-block"><div class="ubbcode-header">Quote:</div><div class="ubbcode-body">Originally posted by The Supply Guy:
<span style="font-weight: bold">Is this what you're looking for??
....</span></div></div>

Thanks, Joel! That looks good, but I don't know how to use a script within Hyena.

If you could give me a little more info on how you would use it that'd be great!

I'd really like to have an export of the data to use for reporting purposes; that is, a dump of the collected data into one CSV file. None of the tools I've seen will do that. I'm hoping Hyena will get an update soon.... (-:

[Guest]

Re: Process owners

<div class="ubbcode-block"><div class="ubbcode-header">Quote:</div><div class="ubbcode-body">Originally posted by kstanush:
<span style="font-weight: bold">I can add a small dialog in the next update....</span></div></div>

I've got my fingers crossed! (-:

[kstanush]

Re: Process owners

Keep in mind that even if I add a dialog to show the process owner, it will only be available on a per-computer basis and interactively too. There isn't any way to have either Hyena or Exporter Pro make a WMI method call through a WMI query.

To join the Hyena beta list, send a blank email to [email protected]

[Guest]

Re: Process owners

This is rhetorical, not looking for an asnwer.

So how do tools like XP's tasklist and SysInternals' PSList get that information? Are they using WMI or some other method?

[kstanush]

Re: Process owners

God only knows. If Microsoft develops a tool, they have access to not only all of the developers of Windows, but all of the internal knowledge on where/how this stuff is stored. SysInternals has some of the best system programmers anywhere (probably jsut as good or better than anyone at Microsoft), and they know how to get at the internals of Windows. You can tell that just by looking at the tools and products that they sell and give away.

But there isn't any documented method of getting remote process information from Windows that I am aware of except for the performance library, and it does not include the process owner. Adding similar functionality to Hyena would make for possible instability problems and other support nightmares.

[kstanush]

Re: Process owners

I don't see pslist showing the remote process owner. pslist using the perfmon library, just like Hyena's Performance Object.

Let me know how you get the task manager to show a remote system. But I think that it uses WMI.

[Guest]

Re: Process owners

Oops...sorry...PSList doesn't show owner info.

Tasklist on XP will show owner info on remote and local machines using /v. It works against 2003, 2000, and XP machines. Not sure about NT4.

[kstanush]

Re: Process owners

The current rev 'D' of the beta of Hyena v6.6 has an option to view the owners of remote processes using WMI.

To join the beta group, send a blank email to [email protected]

[Guest]

Re: Process owners

Woohoo!

Thanks!