Way 1, WSH vbscript, WMI query:
GetProcessInfo.vbs:
strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colProcessList = objWMIService.ExecQuery("SELECT * FROM Win32_Process WHERE (Name = ""winword.exe"" OR Name = ""WORDVIEW.EXE"") ")
Dim strInfo
Wscript.Echo "Caption ProcessId ParentProcessId SessionId ThreadCount UserName CommandLine"
For Each objProcess in colProcessList
strInfo = objProcess.Caption
strInfo = strInfo & " " & objProcess.ProcessId
strInfo = strInfo & " " & objProcess.ParentProcessId
strInfo = strInfo & " " & objProcess.SessionId
strInfo = strInfo & " " & objProcess.ThreadCount
objProcess.GetOwner strNameOfUser, strUserDomain
strInfo = strInfo & " " & strUserDomain & "\" & strNameOfUser
strInfo = strInfo & " " & objProcess.CommandLine
Wscript.Echo strInfo
Next
Output:
Caption ProcessId ParentProcessId SessionId ThreadCount UserName CommandLine
WINWORD.EXE 10032 10480 0 7 HT\Administrator "C:\App32\Microsoft Office\Office12\WINWORD.EXE"
WORDVIEW.EXE 17120 17800 0 4 HT\Administrator "C:\App32\Microsoft Office\OFFICE11\WORDVIEW.EXE"
Get SessionId command line:
query user
Output:
USERNAME SESSIONNAME ID STATE IDLE TIME LOGON TIME
>administrator console 0 Active . 13.08.2013 18:52
Way 2, tasklist, command line:
tasklist /FI "IMAGENAME eq WINWORD.EXE" /V /FO CSV | find /V /I "INFO:"
tasklist /FI "IMAGENAME eq WORDVIEW.EXE" /V /FO CSV | find /V /I "INFO:"
Way 3, Task Manager GUI:
![Task Manager User Name, PID, SessionID](../../I/static/images/fe27a543307032d099e1179c0db4162c9b212c00c2d2beb84b4efc9c910bad4c.jpg)
Way 4, command line, powershell:
powershell ps^|?{$_.Name -eq'WINWORD' -or $_.Name -eq'WORDVIEW'}^|FT MainWindowTitle,Path,Id,Name,SessionId -Au;query user
Way 5, powershell script:
GetProcessInfo.ps1:
$own=@{};gwmi win32_process|%{$own[$_.handle]=$_.getowner().user}
ps|?{$_.Name -eq 'WINWORD' -or $_.Name -eq 'WORDVIEW'}|FT MainWindowTitle,Path,SessionId,Name,Id,@{n="Owner";e={$own[$_.Id.ToString()]}} -Au
Update, see again. – STTR – 2013-08-19T13:40:00.237