@EXECARRAY[WMIQUERY ...]

[vefatica]

Notice below that there is no output line corresponding to ExecutablePath or CommandLine.

v:\> wmiquery . "Select CreationDate,Name,ExecutablePath,HandleCount,KernelModeTime,UserModeTime,ParentProcessId,WorkingSetSize,ThreadCount,CommandLine from Win32_process where ProcessId=3228"
CreationDate = 20200114170420.157712-300
HandleCount = 96
KernelModeTime = 312500
Name = w32tmsvc.exe
ParentProcessId = 828
ThreadCount = 3
UserModeTime = 156250
WorkingSetSize = 2985984

Comparing things to what I see in the WmiCodeCreator I'd guess (not sure) that it's TCC deciding not to print a line when there's no vaule for the property. That doesn't work well if I want to @EXECARRAY[WMIQUERY ...] and be confident about what each line in the array represents. If it is TCC doing that, could it be made to (perhaps optionally) print the line with with an empty value?[/code]

 

[Joe Caverly]

When I run this as elevated admin;

e:\utils>wmiquery . "Select CreationDate,Name,ExecutablePath,HandleCount,KernelModeTime,UserModeTime,ParentProcessId,WorkingSetSize,ThreadCount,CommandLine from Win32_process where ProcessId=13108"
CommandLine = "C:\Program Files\JPSoft\TCMD25\TCC.EXE"
CreationDate = 20200117115444.565894-300
ExecutablePath = C:\Program Files\JPSoft\TCMD25\TCC.EXE
HandleCount = 646
KernelModeTime = 216875000
Name = tcc.exe
ParentProcessId = 14868
ThreadCount = 12
UserModeTime = 94218750
WorkingSetSize = 110551040

Joe

 

[Joe Caverly]

From WMIC - Windows Management - Windows CMD - SS64.com

To run WMIC requires administrator rights and for many operations Elevation.

Joe

 

[vefatica]

... no big deal. I found a rather elegant way to do things without using an array. It's quite simple if I use WMI's names for the properties.

do line in /P `wmiquery . "Select CommandLine,CreationDate,ExecutablePath,HandleCount,KernelModeTime,Name,ParentProcessId,ThreadCount,UserModeTime,WorkingSetSize from Win32_process where ProcessId=%pid"`
    set %@word[" =",0,%line]=%@word[" =",1-,%line]
enddo