Search This Blog

Monday 7 February 2011

Windows, vb script to get the process data

this script prints the process start time

it can be run in this way
cscript <scriptname>.vbs <processname>
for example, if this script has been saved as the file named procInfo.vbs, in order to inspect all running instances of notepad.exe, it can be run as
cscript procInfo.vbs notepad.exe

procName = WScript.Arguments.Item(0)
strComputer = "."
Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colProcesses = objWMIService.ExecQuery("Select * from Win32_Process Where Name = '" & procName & "'")
For Each item In colProcesses
  WScript.Echo(WMIDateStringToDate(item.CreationDate) & ", cmdLine " & item.CommandLine)
Next

Function WMIDateStringToDate(dtmDate)
  WMIDateStringToDate = CDate(Mid(dtmDate, 5, 2) & "/" & _
  Mid(dtmDate, 7, 2) & "/" & Left(dtmDate, 4) _
    & " " & Mid (dtmDate, 9, 2) & ":" & Mid(dtmDate, 11, 2) & ":" & Mid(dtmDate,13, 2))
End Function

No comments:

Post a Comment