How to get specific process with specific owner

Dear kurtbuff

This can only be done if you write a complete script, not with a single WMI query. Please have a look at the getowner() method of the Get-WmiObject win32_process query.

Thanks. I will investigate writing this up in PowerShell, and will post back a sample once I get it working.

Kurt

Gave up on powershell. Instead, I'm using a very simple batch file, and still can't get it to work.

I've put together a batchfile, and it works just fine when run manually (that is, it does return 0 when at least one instance of the executable is in memory running in the context of the stated user), but fails with the following message:

"\Windows\system32>wmic /node:computer process where name="example.exe" call getowner | findstr username ERROR: Description = Access is denied. 1 was unexpected at this time. C:\Windows\system32>if 1 1 goto SendMessage"

The batchfile looks like this (send-message.cmd uses blat to send an email to several people):

---------- wmic /node:computer process where name="example.exe" call getowner | findstr username if %errorlevel% 1 goto SendMessage if %errorlevel% 0 goto ExitClean

:SendMessage "c:\program files (x86)\prtg network monitor\custom sensors\exe\send-message.cmd" echo 2:example.exe Not Running Exit 2

:ExitClean echo 0:ok Exit 0 ----------

Please check if you set the proper security context for the script. This can be done in the sensor configuration tab.

I have tried both settings: "Use security context of probe service" (the service runs under localsystem) and "Use Windows credentials of parent device" (which inherits all the way from the device group of which the monitored server is a member, and that account has local admin rights on the monitored machines.)

Neither works.

Kurt

Dear Kurt

Please try Powershell for these kind of queries. When you set the correct executionpolicy, the script should run.

Did you ever get a powershell script to accomplish this? I'm looking for the same result and my powershell abilities are not getting me to the right solution.

Here is an (extremely simple) example, using local WMI, which just lists the owner name of each process:

$processes=Get-WmiObject win32_process
foreach ($process in $processes)
   {
   $owner=$process.GetOwner()
   write-host $process.Name "is owned by" $owner.User
   }