Is there a way to see current environment variables for a process with WMI?

Question

I have a weird problem where something is changing my path in my login session. The permanent path in the registry is not changing.

I wanted to monitor changes to the explorer.exe process's environment variables using Register-CimIndicationEvent with the Win32_Process CIM object. However, I don't see anything about environment variables there. Is there a property I am missing? Is there another way to get the current environment for another process, and track changes to it?

There is a Win32_Environment class. However, it reads from the registry tags where environment variables are stored. It doesn't read the working variables.

Answer 1

I the environment is not something that is available easily through any API or through WMI.

The simplest route to track your environment would be to make regular checks through Process Explorer to see when the change is happening.

If you can handle writing a bit of C++ code here are a couple of resource on how to access another process' environment. You could use that to create a tool to monitor the environment for you:

• Check for environment variable in another process?
• Read Environment Strings of Remote Process