wmi Win32_Process reference for Network Programming in .NET with C# & Visual Basic .NET (VB.NET)

WMI class ' Win32_Process ' reference for C# and VB.NET

MOF Reference

[Description("The Win32_Process class represents a sequence of events on a Win32 system. Any sequence consisting of the interaction of one or more processors or interpreters, some executable code, and a set of inputs, is a descendent (or member) of this class.\nExample: A client application running on a Win32 system."): ToSubClass, DisplayName("Processes"), AMENDMENT, LOCALE(1033)]
class Win32_Process : CIM_Process
{
	[Description("Time in kernel mode, in 100 nanoseconds. If this information is not available, a value of 0 should be used."): ToSubClass] uint64 KernelModeTime = NULL;
	[Description("The Priority property indicates the scheduling priority of the process within the operating system. The higher the value, the higher priority the process receives. Priority values can range from 0 (lowest priority) to 31 (highest priority).\nExample: 7."): ToSubClass, DisplayName("Priority")] uint32 Priority = NULL;
	[Description("Time in user mode, in 100 nanoseconds. If this information is not available, a value of 0 should be used."): ToSubClass] uint64 UserModeTime = NULL;
	[DisplayName("Executable Path"), Description("The ExecutablePath property indicates the path to the executable file of the process.\nExample: C:\\WINDOWS\\EXPLORER.EXE"): ToSubClass] string ExecutablePath;
	[DisplayName("Maximum Working Set Size"), Description("The MaximumWorkingSetSize property indicates the maximum working set size of the process. The working set of a process is the set of memory pages currently visible to the process in physical RAM. These pages are resident and available for an application to use without triggering a page fault.\nExample: 1413120."): ToSubClass] uint32 MaximumWorkingSetSize;
	[DisplayName("Minimum Working Set Size"), Description("The MinimumWorkingSetSize property indicates the minimum working set size of the process. The working set of a process is the set of memory pages currently visible to the process in physical RAM. These pages are resident and available for an application to use without triggering a page fault.\nExample: 20480."): ToSubClass] uint32 MinimumWorkingSetSize;
	[DisplayName("Number Of Page Faults"), Description("The PageFaults property indicates the number of page faults generated by the process.\nExample: 10"): ToSubClass] uint32 PageFaults;
	[DisplayName("Page File Usage"), Description("The PageFileUsage property indicates the amountof page file space currently being used by the process.\nExample: 102435"): ToSubClass] uint32 PageFileUsage;
	[DisplayName("Peak Page File Usage"), Description("The PeakPageFileUsage property indicates the maximum amount of page file space  used during the life of the process.\nExample: 102367"): ToSubClass] uint32 PeakPageFileUsage;
	[DisplayName("Peak Working Set Size"), Description("The PeakWorkingSetSize property indicates the peak working set size of the process.\nExample: 1413120"): ToSubClass] uint32 PeakWorkingSetSize;
	[DisplayName("Process Id"), Description("The ProcessId property contains the global process identifier that can be used to identify a process. The value is valid from the creation of the process until the process is terminated."): ToSubClass] uint32 ProcessId;
	[DisplayName("Non-Paged Pool Usage Quota"), Description("The QuotaNonPagedPoolUsage property indicates the quota amount of non-paged pool usage for the process.\nExample: 15"): ToSubClass] uint32 QuotaNonPagedPoolUsage;
	[DisplayName("Paged Pool Usage Quota"), Description("The QuotaPagedPoolUsage property indicates the quota amount of paged pool usage for the process.\nExample: 22"): ToSubClass] uint32 QuotaPagedPoolUsage;
	[DisplayName("Peak Non-Paged Pool Usage Quota"), Description("The QuotaPeakNonPagedPoolUsage property indicates the peak quota amount of non-paged pool usage for the process.\nExample: 31"): ToSubClass] uint32 QuotaPeakNonPagedPoolUsage;
	[DisplayName("Peak Paged Pool Usage Quota"), Description("The QuotaPeakPagedPoolUsage property indicates the peak quota amount of paged pool usage for the process.\n Example: 31"): ToSubClass] uint32 QuotaPeakPagedPoolUsage;
	[DisplayName("Windows Version"), Description("The WindowsVersion property indicates the version of Windows in which the process is running.\nExample: 4.0"): ToSubClass] string WindowsVersion;
	[DisplayName("Thread Count"), Description("The ThreadCount property specifies the number of active threads in this process. An instruction is the basic unit of execution in a processor, and a thread is the object that executes instructions. Every running process has at least one thread. This property is for computers running Windows NT only."): ToSubClass] uint32 ThreadCount;
	[DisplayName("Handle Count"), Description("The HandleCount property specifies the total number of handles currently open by this process. This number is the sum of the handles currently open by each thread in this process. A handle is used to examine or modify the system resources. Each handle has an entry in an internally maintained table. These entries contain the addresses of the resources and the means to identify the resource type."): ToSubClass] uint32 HandleCount;
	[DisplayName("Parent Process Id"), Description("The ParentProcessId property specifies the unique identifier of the process that created this process. Process identifier numbers are reused, so they only identify a process for the lifetime of that process. It is possible that the process identified by ParentProcessId has terminated, so ParentProcessId may not refer to an running process. It is also possible that ParentProcessId incorrectly refers to a process which re-used that process identifier. The CreationDate property can be used to determine whether the specified parent was created after this process was created."): ToSubClass] uint32 ParentProcessId;
	[DisplayName("Session Id"), Description("The SessionId property specifies the unique identifier that is generated by the operating system when the session is created. A session spans a period of time from log in to log out on a particular system."): ToSubClass] uint32 SessionId;
	[DisplayName("Private Page Count"), Description("The PrivatePageCount property specifies the current number of pages allocated that are accessible only to this process "): ToSubClass] uint64 PrivatePageCount;
	[DisplayName("Peak Virual Address Space Usage"), Description("The PeakVirtualSize property specifies the maximum virtual address space the process has used at any one time. Use of virtual address space does not necessarily imply corresponding use of either disk or main memory pages. However, virtual space is finite, and by using too much, the process might limit its ability to load libraries."): ToSubClass] uint64 PeakVirtualSize;
	[DisplayName("Virtual Address Space Usage"), Description("The VirtualSize property specifies the current size in bytes of the virtual address space the process is using. Use of virtual address space does not necessarily imply corresponding use of either disk or main memory pages. Virtual space is finite, and by using too much, the process can limit its ability to load libraries."): ToSubClass] uint64 VirtualSize;
	[DisplayName("Read Operation Count"), Description("The ReadOperationCount property specifies the number of read operations performed."): ToSubClass] uint64 ReadOperationCount;
	[DisplayName("Write Operation Count"), Description("The WriteOperationCount property specifies the number of write operations performed."): ToSubClass] uint64 WriteOperationCount;
	[DisplayName("Other Operation Count"), Description("The OtherOperationCount property specifies the number of I/O operations performed, other than read and write operations."): ToSubClass] uint64 OtherOperationCount;
	[DisplayName("Read Transfer Count"), Description("The ReadTransferCount property specifies the amount of data read."): ToSubClass] uint64 ReadTransferCount;
	[DisplayName("Write Transfer Count"), Description("The WriteTransferCount property specifies the amount of data written."): ToSubClass] uint64 WriteTransferCount;
	[DisplayName("Other Transfer Count"), Description("The OtherTransferCount property specifies the amount of data transferred during operations other than read and write operations."): ToSubClass] uint64 OtherTransferCount;
	[DisplayName("Command Line To Start Process"), Description("The CommandLine property specifies the command line used to start a particular process, if applicable."): ToSubClass] string CommandLine;
	[Description("The Create method creates a new process. \nThe method returns an integer value that can be interpretted as follows: \n0 - Successful completion.\n2 - The user does not have access to the requested information.\n3 - The user does not have sufficient privilge.\n8 - Unknown failure.\n9 - The path specified does not exist.\n21 - The specified parameter is invalid.\nOther - For integer values other than those listed above, refer to Win32 error code documentation."): ToSubClass, Values{"Successful completion", "Access denied", "Insufficient privilege", "Unknown failure", "Path not found", "Invalid parameter", "Other"}: ToSubClass] uint32 Create([In, Description("The CommandLine parameter specifies the command line to execute.  The system adds a null character to the command line, trimming the string if necessary, to indicate which file was actually used. A fully qualified path must be specified in cases where the program to be launched is not in the search path of Winmgmt (not the user's path)."): ToSubClass] string CommandLine, [In, Description("The CurrentDirectory parameter specifies the current drive and directory for the child process. The string requires that the current directory resolves to a known path. A user can specify an absolute path or a path relative to the current working directory. If this parameter is NULL, the new process will have the same path as the calling process. This option is provided primarily for shells that must start an application and specify the application's initial drive and working directory."): ToSubClass] string CurrentDirectory, [In, Description("The ProcessStartupInformation parameter represents the startup configuration of a Win32 process. It includes information about displaying the window, characteristics of a console application, and handling errors. \n\nNote that in Windows XP and beyond, the WinstationDesktop string property (which previously defaulted to \"winsta0\\default\") is ignored in all cases. The value used in place of this parameter is an empty string (\"\")."): ToSubClass] Win32_ProcessStartup ProcessStartupInformation, [Out, Description("The ProcessId parameter returns a global process identifier that can be used to identify a process. The value is valid from the time the process is created until the time the process is terminated. "): ToSubClass] uint32 ProcessId);
	[Description("The Terminate method terminates a process and all of its threads. The method returns an integer value that can be interpretted as follows: \n0 - Successful completion.\n2 - The user does not have access to the requested information.\n3 - The user does not have sufficient privilge.\n8 - Unknown failure.\n9 - The path specified does not exist.\n21 - The specified parameter is invalid.\nOther - For integer values other than those listed above, refer to Win32 error code documentation."): ToSubClass, Values{"Successful completion", "Access denied", "Insufficient privilege", "Unknown failure", "Path not found", "Invalid parameter", "Other"}: ToSubClass] uint32 Terminate([In, Description("The Reason parameter specifies the exit code for the process and for all threads terminated as a result of this call. "): ToSubClass] uint32 Reason);
	[Description("The GetOwner method retrieves the user name and domain name under which the process is running. \nThe method returns an integer value that can be interpretted as follows: \n0 - Successful completion.\n2 - The user does not have access to the requested information.\n3 - The user does not have sufficient privilge.\n8 - Unknown failure.\n9 - The path specified does not exist.\n21 - The specified parameter is invalid.\nOther - For integer values other than those listed above, refer to Win32 error code documentation."): ToSubClass, Values{"Successful completion", "Access denied", "Insufficient privilege", "Unknown failure", "Path not found", "Invalid parameter", "Other"}: ToSubClass] uint32 GetOwner([Out, Description("The User parameter returns the user name of the owner of this process."): ToSubClass] string User, [Out, Description("The Domain parameter returns the domain name under which this process is running."): ToSubClass] string Domain);
	[Description("The GetOwnerSid method retrieves the security identifier (SID) for the owner of this process.\nThe method returns an integer value that can be interpretted as follows: \n0 - Successful completion.\n2 - The user does not have access to the requested information.\n3 - The user does not have sufficient privilge.\n8 - Unknown failure.\n9 - The path specified does not exist.\n21 - The specified parameter is invalid.\nOther - For integer values other than those listed above, refer to Win32 error code documentation."): ToSubClass, Values{"Successful completion", "Access denied", "Insufficient privilege", "Unknown failure", "Path not found", "Invalid parameter", "Other"}: ToSubClass] uint32 GetOwnerSid([Out, Description("The Sid property returns the security identifier descriptor for this process."): ToSubClass] string Sid);
	[Description("The SetPriority method attempts to change the execution priority of the process. In order to set the priority to Realtime, the caller must hold the SeIncreaseBasePriorityPrivilege.  Without this privilege, the highest the priority can be set to is High priority.\nThe method returns an integer value that can be interpretted as follows: \n0 - Successful completion.\n2 - The user does not have access to the requested information.\n3 - The user does not have sufficient privilge.\n8 - Unknown failure.\n9 - The path specified does not exist.\n21 - The specified parameter is invalid.\nOther - For integer values other than those listed above, refer to Win32 error code documentation."): ToSubClass, Values{"Successful completion", "Access denied", "Insufficient privilege", "Unknown failure", "Path not found", "Invalid parameter", "Other"}: ToSubClass] uint32 SetPriority([in, Description("The Priority parameter specifies the new priority class for the process.  Values:\nIdle - Specified for a process whose threads run only when the system is idle. The threads of the process are preempted by the threads of any process running in a higher priority class. An example is a screen saver. The idle-priority class is inherited by child processes.\nBelow Normal - Indicates a process that has priority above IDLE_PRIORITY_CLASS but below NORMAL_PRIORITY_CLASS. For Windows 2000.\nNormal - Specified for a process with no special scheduling needs.\nAbove Normal - Indicates a process that has priority above NORMAL_PRIORITY_CLASS but below HIGH_PRIORITY_CLASS. For Windows 2000.\nHigh Priority - Specified for a process that performs time-critical tasks that must be executed immediately. The threads of the process preempt the threads of normal or idle priority class processes. An example is the Task List, which must respond quickly when called by the user, regardless of the load on the operating system. Use extreme care when using the high-priority class, because a high-priority class application can use nearly all available CPU time.\nRealtime - Specified for a process that has the highest possible priority. The threads of the process preempt the threads of all other processes, including operating system processes performing important tasks. For example, a real-time process that executes for more than a very brief interval can cause disk caches not to flush or cause the mouse to be unresponsive.\n"): ToSubClass, Values{"Idle", "Below Normal", "Normal", "Above Normal", "High Priority", "Realtime"}: ToSubClass] sint32 Priority);
	[Description("The AttachDebugger method launches the currently registered debugger for this process.  Dr. Watson, however, is not supported. \nThe method returns a 'generic failure' if it finds an invalid string in the registry key or an integer value that can be interpretted as follows: \n0 - Successful completion.\n2 - The user does not have access to the requested information.\n3 - The user does not have sufficient privilge.\n8 - Unknown failure.\n9 - The path specified does not exist.\n21 - The specified parameter is invalid.\nOther - For integer values other than those listed above, refer to Win32 error code documentation."): ToSubClass, Values{"Successful completion", "Access denied", "Insufficient privilege", "Unknown failure", "Path not found", "Invalid parameter", "Other"}: ToSubClass] uint32 AttachDebugger();
};

Class properties:

Win32_Process.Caption
Win32_Process.CommandLine
Win32_Process.CreationClassName
Win32_Process.CreationDate
Win32_Process.CSCreationClassName
Win32_Process.CSName
Win32_Process.Description
Win32_Process.ExecutablePath
Win32_Process.ExecutionState
Win32_Process.Handle
Win32_Process.HandleCount
Win32_Process.InstallDate
Win32_Process.KernelModeTime
Win32_Process.MaximumWorkingSetSize
Win32_Process.MinimumWorkingSetSize
Win32_Process.Name
Win32_Process.OSCreationClassName
Win32_Process.OSName
Win32_Process.OtherOperationCount
Win32_Process.OtherTransferCount
Win32_Process.PageFaults
Win32_Process.PageFileUsage
Win32_Process.ParentProcessId
Win32_Process.PeakPageFileUsage
Win32_Process.PeakVirtualSize
Win32_Process.PeakWorkingSetSize
Win32_Process.Priority
Win32_Process.PrivatePageCount
Win32_Process.ProcessId
Win32_Process.QuotaNonPagedPoolUsage
Win32_Process.QuotaPagedPoolUsage
Win32_Process.QuotaPeakNonPagedPoolUsage
Win32_Process.QuotaPeakPagedPoolUsage
Win32_Process.ReadOperationCount
Win32_Process.ReadTransferCount
Win32_Process.SessionId
Win32_Process.Status
Win32_Process.TerminationDate
Win32_Process.ThreadCount
Win32_Process.UserModeTime
Win32_Process.VirtualSize
Win32_Process.WindowsVersion
Win32_Process.WorkingSetSize
Win32_Process.WriteOperationCount
Win32_Process.WriteTransferCount

WMI is a huge subject, so therefore it is practically impossible to provide a comprehensive example program that covers anything. However, the book �Network programming in .NET� (Buy at Amazon UK) (Buy at Amazon US) covers a much wider scope of WMI, and explains how to leverage it to access the bounty of information held within this vast, yet simple object model.

Articles

Contact us

Please use FireFox to view this page

WMI class ' Win32_Process ' reference for C# and VB.NET

MOF Reference

Class properties: