@EXECARRAY[WMIQUERY ...]

May 20, 2008
10,631
81
Syracuse, NY, USA
Notice below that there is no output line corresponding to ExecutablePath or CommandLine.

Code:
v:\> wmiquery . "Select CreationDate,Name,ExecutablePath,HandleCount,KernelModeTime,UserModeTime,ParentProcessId,WorkingSetSize,ThreadCount,CommandLine from Win32_process where ProcessId=3228"
CreationDate = 20200114170420.157712-300
HandleCount = 96
KernelModeTime = 312500
Name = w32tmsvc.exe
ParentProcessId = 828
ThreadCount = 3
UserModeTime = 156250
WorkingSetSize = 2985984
Comparing things to what I see in the WmiCodeCreator I'd guess (not sure) that it's TCC deciding not to print a line when there's no vaule for the property. That doesn't work well if I want to @EXECARRAY[WMIQUERY ...] and be confident about what each line in the array represents. If it is TCC doing that, could it be made to (perhaps optionally) print the line with with an empty value?[/code]
 
Last edited:
When I run this as elevated admin;
Code:
e:\utils>wmiquery . "Select CreationDate,Name,ExecutablePath,HandleCount,KernelModeTime,UserModeTime,ParentProcessId,WorkingSetSize,ThreadCount,CommandLine from Win32_process where ProcessId=13108"
CommandLine = "C:\Program Files\JPSoft\TCMD25\TCC.EXE"
CreationDate = 20200117115444.565894-300
ExecutablePath = C:\Program Files\JPSoft\TCMD25\TCC.EXE
HandleCount = 646
KernelModeTime = 216875000
Name = tcc.exe
ParentProcessId = 14868
ThreadCount = 12
UserModeTime = 94218750
WorkingSetSize = 110551040
Joe
 
May 20, 2008
10,631
81
Syracuse, NY, USA
... no big deal. I found a rather elegant way to do things without using an array. It's quite simple if I use WMI's names for the properties.

Code:
do line in /P `wmiquery . "Select CommandLine,CreationDate,ExecutablePath,HandleCount,KernelModeTime,Name,ParentProcessId,ThreadCount,UserModeTime,WorkingSetSize from Win32_process where ProcessId=%pid"`
    set %@word[" =",0,%line]=%@word[" =",1-,%line]
enddo