Win32_Process, ROOT\CIMV2

Class | Methods (7) | Properties (45) | Qualifiers (10) | Instances (40) | Namespaces (2)
Samples: VB Script | C# | VB.Net | Search on:Microsoft

Description

The Win32_Process class represents a sequence of events on a Win32 system. Any sequence consisting of the interaction of one or more processors or interpreters, some executable code, and a set of inputs, is a descendent (or member) of this class. Example: A client application running on a Win32 system.

Win32_Process methods

Win32_Process has 7 methods (7 Local)

NameOriginReturn
AttachDebuggerWin32_Processuint32 {'out':True}
CreateWin32_Processuint32 {'out':True}
GetAvailableVirtualSizeWin32_Processuint32 {'out':True}
GetOwnerWin32_Processuint32 {'out':True}
GetOwnerSidWin32_Processuint32 {'out':True}
SetPriorityWin32_Processuint32 {'out':True}
TerminateWin32_Processuint32 {'out':True}

Win32_Process properties

Win32_Process has 45 properties (27 Local, 18 Derived)

NameOriginCIMType
CaptionCIM_ManagedSystemElement8 [string]
CommandLineWin32_Process8 [string]
CreationClassNameCIM_Process8 [string]
CreationDateCIM_Process101 [datetime]
CSCreationClassNameCIM_Process8 [string]
CSNameCIM_Process8 [string]
DescriptionCIM_ManagedSystemElement8 [string]
ExecutablePathWin32_Process8 [string]
ExecutionStateCIM_Process18 [uint16]
key
Handle
CIM_Process8 [string]
HandleCountWin32_Process19 [uint32]
InstallDateCIM_ManagedSystemElement101 [datetime]
KernelModeTimeCIM_Process21 [uint64]
MaximumWorkingSetSizeWin32_Process19 [uint32]
MinimumWorkingSetSizeWin32_Process19 [uint32]
NameCIM_ManagedSystemElement8 [string]
OSCreationClassNameCIM_Process8 [string]
OSNameCIM_Process8 [string]
OtherOperationCountWin32_Process21 [uint64]
OtherTransferCountWin32_Process21 [uint64]
PageFaultsWin32_Process19 [uint32]
PageFileUsageWin32_Process19 [uint32]
ParentProcessIdWin32_Process19 [uint32]
PeakPageFileUsageWin32_Process19 [uint32]
PeakVirtualSizeWin32_Process21 [uint64]
PeakWorkingSetSizeWin32_Process19 [uint32]
PriorityCIM_Process19 [uint32]
PrivatePageCountWin32_Process21 [uint64]
ProcessIdWin32_Process19 [uint32]
QuotaNonPagedPoolUsageWin32_Process19 [uint32]
QuotaPagedPoolUsageWin32_Process19 [uint32]
QuotaPeakNonPagedPoolUsageWin32_Process19 [uint32]
QuotaPeakPagedPoolUsageWin32_Process19 [uint32]
ReadOperationCountWin32_Process21 [uint64]
ReadTransferCountWin32_Process21 [uint64]
SessionIdWin32_Process19 [uint32]
StatusCIM_ManagedSystemElement8 [string]
TerminationDateCIM_Process101 [datetime]
ThreadCountWin32_Process19 [uint32]
UserModeTimeCIM_Process21 [uint64]
VirtualSizeWin32_Process21 [uint64]
WindowsVersionWin32_Process8 [string]
WorkingSetSizeCIM_Process21 [uint64]
WriteOperationCountWin32_Process21 [uint64]
WriteTransferCountWin32_Process21 [uint64]

Detailed description of Win32_Process methods

Local methods (7) of Win32_Process class

AttachDebugger method
Returnuint32 {'out':True}
Description'The AttachDebugger method launches the currently registered debugger for this process. Dr. Watson, however, is not supported.
The method returns a 'generic failure' if it finds an invalid string in the registry key or an integer value that can be interpretted as follows:
0 - Successful completion.
2 - The user does not have access to the requested information.
3 - The user does not have sufficient privilge.
8 - Unknown failure.
9 - The path specified does not exist.
21 - The specified parameter is invalid.
Other - For integer values other than those listed above, refer to Win32 error code documentation.'
ImplementedTrue
ValueMap['0', '2', '3', '8', '9', '21', '..']
Values['Successful completion', 'Access denied', 'Insufficient privilege', 'Unknown failure', 'Path not found', 'Invalid parameter', 'Other']
AttachDebugger method is in 1 class (Win32_Process) of ROOT\cimv2 and in 2 namespaces
Create method
Returnuint32 {'out':True}
Parameters
NameCIMTypeIDINOUTQualifiers
CommandLinestring0-{'Description':'The CommandLine parameter specifies the command line to execute. The system adds a null character to the command line, trimming the string if necessary, to indicate which file was actually used. A fully qualified path must be specified in cases where the program to be launched is not in the search path of Winmgmt (not the user's path).','In':True,'MappingStrings':['Win32API|Process and Thread Functions|lpCommandLine ']}
CurrentDirectorystring1-{'Description':'The CurrentDirectory parameter specifies the current drive and directory for the child process. The string requires that the current directory resolves to a known path. A user can specify an absolute path or a path relative to the current working directory. If this parameter is NULL, the new process will have the same path as the calling process. This option is provided primarily for shells that must start an application and specify the application's initial drive and working directory.','In':True,'MappingStrings':['Win32API|Process and Thread Functions|CreateProcess|lpCurrentDirectory ']}
ProcessStartupInformationobject:Win32_ProcessStartup2-{'Description':'The ProcessStartupInformation parameter represents the startup configuration of a Win32 process. It includes information about displaying the window, characteristics of a console application, and handling errors. Note that in Windows XP and beyond, the WinstationDesktop string property (which previously defaulted to "winsta0\default") is ignored in all cases. The value used in place of this parameter is an empty string ("").','In':True,'MappingStrings':['WMI|Win32_ProcessStartup']}
ProcessIduint323-{'Description':'The ProcessId parameter returns a global process identifier that can be used to identify a process. The value is valid from the time the process is created until the time the process is terminated. ','MappingStrings':['Win32API|Process and Thread Functions|CreateProcess|lpProcessInformation|dwProcessId'],'Out':True}
ConstructorTrue
Description'The Create method creates a new process.
The method returns an integer value that can be interpretted as follows:
0 - Successful completion.
2 - The user does not have access to the requested information.
3 - The user does not have sufficient privilge.
8 - Unknown failure.
9 - The path specified does not exist.
21 - The specified parameter is invalid.
Other - For integer values other than those listed above, refer to Win32 error code documentation.'
ImplementedTrue
MappingStrings['Win32API|Process and Thread Functions|CreateProcess']
Privileges['SeAssignPrimaryTokenPrivilege', 'SeIncreaseQuotaPrivilege', 'SeRestorePrivilege']
StaticTrue
ValueMap['0', '2', '3', '8', '9', '21', '..']
Values['Successful completion', 'Access denied', 'Insufficient privilege', 'Unknown failure', 'Path not found', 'Invalid parameter', 'Other']
Create method is in 11 classes of ROOT\cimv2 and in 14 namespaces
GetAvailableVirtualSize method
Returnuint32 {'out':True}
Parameters
NameCIMTypeIDINOUTQualifiers
AvailableVirtualSizeuint640-{'Description':'The AvailableVirtualSize property returns the free virtual address space available to this process.','MappingStrings':['WMI'],'Out':True}
Description'The GetAvailableVirtualSize method retrieves the currently size in bytes of the free virtual address space available to this process.
The method returns an integer value that can be interpretted as follows:
0 - Successful completion.
2 - The user does not have access to the requested information.
3 - The user does not have sufficient privilge.
8 - Unknown failure.
9 - The path specified does not exist.
21 - The specified parameter is invalid.
Other - For integer values other than those listed above, refer to Win32 error code documentation.'
ImplementedTrue
ValueMap['0', '2', '3', '8', '9', '21', '..']
Values['Successful completion', 'Access denied', 'Insufficient privilege', 'Unknown failure', 'Path not found', 'Invalid parameter', 'Other']
GetAvailableVirtualSize method is in 1 class (Win32_Process) of ROOT\cimv2 and in 2 namespaces
GetOwner method
Returnuint32 {'out':True}
Parameters
NameCIMTypeIDINOUTQualifiers
Userstring0-{'Description':'The User parameter returns the user name of the owner of this process.','MappingStrings':['WMI'],'Out':True}
Domainstring1-{'Description':'The Domain parameter returns the domain name under which this process is running.','MappingStrings':['WMI'],'Out':True}
Description'The GetOwner method retrieves the user name and domain name under which the process is running.
The method returns an integer value that can be interpretted as follows:
0 - Successful completion.
2 - The user does not have access to the requested information.
3 - The user does not have sufficient privilge.
8 - Unknown failure.
9 - The path specified does not exist.
21 - The specified parameter is invalid.
Other - For integer values other than those listed above, refer to Win32 error code documentation.'
ImplementedTrue
MappingStrings['WMI']
ValueMap['0', '2', '3', '8', '9', '21', '..']
Values['Successful completion', 'Access denied', 'Insufficient privilege', 'Unknown failure', 'Path not found', 'Invalid parameter', 'Other']
GetOwner method is in 1 class (Win32_Process) of ROOT\cimv2 and in 2 namespaces
GetOwnerSid method
Returnuint32 {'out':True}
Parameters
NameCIMTypeIDINOUTQualifiers
Sidstring0-{'Description':'The Sid property returns the security identifier descriptor for this process.','MappingStrings':['WMI'],'Out':True}
Description'The GetOwnerSid method retrieves the security identifier (SID) for the owner of this process.
The method returns an integer value that can be interpretted as follows:
0 - Successful completion.
2 - The user does not have access to the requested information.
3 - The user does not have sufficient privilge.
8 - Unknown failure.
9 - The path specified does not exist.
21 - The specified parameter is invalid.
Other - For integer values other than those listed above, refer to Win32 error code documentation.'
ImplementedTrue
MappingStrings['WMI']
ValueMap['0', '2', '3', '8', '9', '21', '..']
Values['Successful completion', 'Access denied', 'Insufficient privilege', 'Unknown failure', 'Path not found', 'Invalid parameter', 'Other']
GetOwnerSid method is in 1 class (Win32_Process) of ROOT\cimv2 and in 2 namespaces
SetPriority method
Returnuint32 {'out':True}
Parameters
NameCIMTypeIDINOUTQualifiers
Prioritysint320-{'Description':'The Priority parameter specifies the new priority class for the process. Values:Idle - Specified for a process whose threads run only when the system is idle. The threads of the process are preempted by the threads of any process running in a higher priority class. An example is a screen saver. The idle-priority class is inherited by child processes.Below Normal - Indicates a process that has priority above IDLE_PRIORITY_CLASS but below NORMAL_PRIORITY_CLASS. For Windows 2000.Normal - Specified for a process with no special scheduling needs.Above Normal - Indicates a process that has priority above NORMAL_PRIORITY_CLASS but below HIGH_PRIORITY_CLASS. For Windows 2000.High Priority - Specified for a process that performs time-critical tasks that must be executed immediately. The threads of the process preempt the threads of normal or idle priority class processes. An example is the Task List, which must respond quickly when called by the user, regardless of the load on the operating system. Use extreme care when using the high-priority class, because a high-priority class application can use nearly all available CPU time.Realtime - Specified for a process that has the highest possible priority. The threads of the process preempt the threads of all other processes, including operating system processes performing important tasks. For example, a real-time process that executes for more than a very brief interval can cause disk caches not to flush or cause the mouse to be unresponsive.','in':True,'MappingStrings':['Win32API|Process and Thread Functions|SetPriorityClass|dwPriorityClass'],'ValueMap':['0x00000040', '0x00004000', '0x00000020', '0x00008000', '0x00000080', '0x00000100'],'Values':['Idle', 'Below Normal', 'Normal', 'Above Normal', 'High Priority', 'Realtime']}
Description'The SetPriority method attempts to change the execution priority of the process. In order to set the priority to Realtime, the caller must hold the SeIncreaseBasePriorityPrivilege. Without this privilege, the highest the priority can be set to is High priority.
The method returns an integer value that can be interpretted as follows:
0 - Successful completion.
2 - The user does not have access to the requested information.
3 - The user does not have sufficient privilge.
8 - Unknown failure.
9 - The path specified does not exist.
21 - The specified parameter is invalid.
Other - For integer values other than those listed above, refer to Win32 error code documentation.'
ImplementedTrue
MappingStrings['Win32API|Process and Thread Functions|SetPriorityClass']
ValueMap['0', '2', '3', '8', '9', '21', '..']
Values['Successful completion', 'Access denied', 'Insufficient privilege', 'Unknown failure', 'Path not found', 'Invalid parameter', 'Other']
SetPriority method is in 2 classes of ROOT\cimv2 and in 2 namespaces
Terminate method
Returnuint32 {'out':True}
Parameters
NameCIMTypeIDINOUTQualifiers
Reasonuint320-{'Description':'The Reason parameter specifies the exit code for the process and for all threads terminated as a result of this call. ','In':True,'MappingStrings':['Win32API|Process and Thread Functions|TerminateProcess|uExitCode ']}
Description'The Terminate method terminates a process and all of its threads. The method returns an integer value that can be interpretted as follows:
0 - Successful completion.
2 - The user does not have access to the requested information.
3 - The user does not have sufficient privilge.
8 - Unknown failure.
9 - The path specified does not exist.
21 - The specified parameter is invalid.
Other - For integer values other than those listed above, refer to Win32 error code documentation.

Note: The SE_DEBUG_PRIVILEGE privilege is required to invoke this method'
DestructorTrue
ImplementedTrue
MappingStrings['Win32API|Process and Thread Functions|TerminateProcess']
Privileges['SeDebugPrivilege']
ValueMap['0', '2', '3', '8', '9', '21', '..']
Values['Successful completion', 'Access denied', 'Insufficient privilege', 'Unknown failure', 'Path not found', 'Invalid parameter', 'Other']
Terminate method is in 1 class (Win32_Process) of ROOT\cimv2 and in 2 namespaces

Detailed description of Win32_Process properties

Local properties (27) of Win32_Process class

CommandLine property
CIMTYPE'string'
Description'The CommandLine property specifies the command line used to start a particular process, if applicable.'
DisplayName'Command Line To Start Process'
readTrue
CommandLine property is in 3 classes of ROOT\cimv2 and in 4 namespaces
ExecutablePath property
CIMTYPE'string'
Description'The ExecutablePath property indicates the path to the executable file of the process.
Example: C:\WINDOWS\EXPLORER.EXE'
DisplayName'Executable Path'
MappingStrings['Win32API|Tool Help Structures|MODULEENTRY32|szExePath']
Privileges['SeDebugPrivilege']
readTrue
ExecutablePath property is in 1 class (Win32_Process) of ROOT\cimv2 and in 6 namespaces
HandleCount property
CIMTYPE'uint32'
Description'The HandleCount property specifies the total number of handles currently open by this process. This number is the sum of the handles currently open by each thread in this process. A handle is used to examine or modify the system resources. Each handle has an entry in an internally maintained table. These entries contain the addresses of the resources and the means to identify the resource type.'
DisplayName'Handle Count'
MappingStrings['Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|HandleCount']
readTrue
HandleCount property is in 7 classes of ROOT\cimv2 and in 4 namespaces
MaximumWorkingSetSize property
CIMTYPE'uint32'
Description'The MaximumWorkingSetSize property indicates the maximum working set size of the process. The working set of a process is the set of memory pages currently visible to the process in physical RAM. These pages are resident and available for an application to use without triggering a page fault.
Example: 1413120.'
DisplayName'Maximum Working Set Size'
MappingStrings['Win32|WINNT.H|QUOTA_LIMITS|MaximumWorkingSetSize']
Privileges['SeDebugPrivilege']
readTrue
Units'kilobytes'
MaximumWorkingSetSize property is in 2 classes of ROOT\cimv2 and in 2 namespaces
MinimumWorkingSetSize property
CIMTYPE'uint32'
Description'The MinimumWorkingSetSize property indicates the minimum working set size of the process. The working set of a process is the set of memory pages currently visible to the process in physical RAM. These pages are resident and available for an application to use without triggering a page fault.
Example: 20480.'
DisplayName'Minimum Working Set Size'
MappingStrings['Win32|WINNT.H|QUOTA_LIMITS|MinimumWorkingSetSize']
Privileges['SeDebugPrivilege']
readTrue
Units'kilobytes'
MinimumWorkingSetSize property is in 2 classes of ROOT\cimv2 and in 2 namespaces
OtherOperationCount property
CIMTYPE'uint64'
Description'The OtherOperationCount property specifies the number of I/O operations performed, other than read and write operations.'
DisplayName'Other Operation Count'
MappingStrings['Win32API|Process and Thread Structures|SYSTEM_PROCESS_INFORMATION|OtherOperationCount']
readTrue
OtherOperationCount property is in 2 classes of ROOT\cimv2 and in 2 namespaces
OtherTransferCount property
CIMTYPE'uint64'
Description'The OtherTransferCount property specifies the amount of data transferred during operations other than read and write operations.'
DisplayName'Other Transfer Count'
MappingStrings['Win32API|Process and Thread Structures|SYSTEM_PROCESS_INFORMATION|OtherTransferCount']
readTrue
Units'bytes'
OtherTransferCount property is in 2 classes of ROOT\cimv2 and in 2 namespaces
PageFaults property
CIMTYPE'uint32'
Description'The PageFaults property indicates the number of page faults generated by the process.
Example: 10'
DisplayName'Number Of Page Faults'
MappingStrings['Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|PageFaultCount']
readTrue
PageFaults property is in 1 class (Win32_Process) of ROOT\cimv2 and in 2 namespaces
PageFileUsage property
CIMTYPE'uint32'
Description'The PageFileUsage property indicates the amountof page file space currently being used by the process.
Example: 102435'
DisplayName'Page File Usage'
MappingStrings['Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|PagefileUsage']
readTrue
Units'kilobytes'
PageFileUsage property is in 1 class (Win32_Process) of ROOT\cimv2 and in 4 namespaces
ParentProcessId property
CIMTYPE'uint32'
Description'The ParentProcessId property specifies the unique identifier of the process that created this process. Process identifier numbers are reused, so they only identify a process for the lifetime of that process. It is possible that the process identified by ParentProcessId has terminated, so ParentProcessId may not refer to an running process. It is also possible that ParentProcessId incorrectly refers to a process which re-used that process identifier. The CreationDate property can be used to determine whether the specified parent was created after this process was created.'
DisplayName'Parent Process Id'
MappingStrings['Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|InheritedFromUniqueProcessId']
readTrue
ParentProcessId property is in 4 classes of ROOT\cimv2 and in 2 namespaces
PeakPageFileUsage property
CIMTYPE'uint32'
Description'The PeakPageFileUsage property indicates the maximum amount of page file space used during the life of the process.
Example: 102367'
DisplayName'Peak Page File Usage'
MappingStrings['Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|PeakPagefileUsage']
readTrue
Units'kilobytes'
PeakPageFileUsage property is in 1 class (Win32_Process) of ROOT\cimv2 and in 4 namespaces
PeakVirtualSize property
CIMTYPE'uint64'
Description'The PeakVirtualSize property specifies the maximum virtual address space the process has used at any one time. Use of virtual address space does not necessarily imply corresponding use of either disk or main memory pages. However, virtual space is finite, and by using too much, the process might limit its ability to load libraries.'
DisplayName'Peak Virual Address Space Usage'
MappingStrings['Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|PeakVirtualSize']
readTrue
Units'bytes'
PeakVirtualSize property is in 1 class (Win32_Process) of ROOT\cimv2 and in 4 namespaces
PeakWorkingSetSize property
CIMTYPE'uint32'
Description'The PeakWorkingSetSize property indicates the peak working set size of the process.
Example: 1413120'
DisplayName'Peak Working Set Size'
MappingStrings['Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|PeakWorkingSetSize']
readTrue
Units'kilobytes'
PeakWorkingSetSize property is in 1 class (Win32_Process) of ROOT\cimv2 and in 4 namespaces
PrivatePageCount property
CIMTYPE'uint64'
Description'The PrivatePageCount property specifies the current number of pages allocated that are accessible only to this process '
DisplayName'Private Page Count'
MappingStrings['Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|PrivatePageCount']
readTrue
PrivatePageCount property is in 1 class (Win32_Process) of ROOT\cimv2 and in 4 namespaces
ProcessId property
CIMTYPE'uint32'
Description'The ProcessId property contains the global process identifier that can be used to identify a process. The value is valid from the creation of the process until the process is terminated.'
DisplayName'Process Id'
MappingStrings['Win32API|Process and Thread Structures|PROCESS_INFORMATION|dwProcessId ']
readTrue
ProcessId property is in 15 classes of ROOT\cimv2 and in 18 namespaces
QuotaNonPagedPoolUsage property
CIMTYPE'uint32'
Description'The QuotaNonPagedPoolUsage property indicates the quota amount of non-paged pool usage for the process.
Example: 15'
DisplayName'Non-Paged Pool Usage Quota'
MappingStrings['Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|QuotaNonPagedPoolUsage']
readTrue
QuotaNonPagedPoolUsage property is in 1 class (Win32_Process) of ROOT\cimv2 and in 4 namespaces
QuotaPagedPoolUsage property
CIMTYPE'uint32'
Description'The QuotaPagedPoolUsage property indicates the quota amount of paged pool usage for the process.
Example: 22'
DisplayName'Paged Pool Usage Quota'
MappingStrings['Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|QuotaPagedPoolUsage']
readTrue
QuotaPagedPoolUsage property is in 1 class (Win32_Process) of ROOT\cimv2 and in 4 namespaces
QuotaPeakNonPagedPoolUsage property
CIMTYPE'uint32'
Description'The QuotaPeakNonPagedPoolUsage property indicates the peak quota amount of non-paged pool usage for the process.
Example: 31'
DisplayName'Peak Non-Paged Pool Usage Quota'
MappingStrings['Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|QuotaPeakNonPagedPoolUsage']
readTrue
QuotaPeakNonPagedPoolUsage property is in 1 class (Win32_Process) of ROOT\cimv2 and in 4 namespaces
QuotaPeakPagedPoolUsage property
CIMTYPE'uint32'
Description'The QuotaPeakPagedPoolUsage property indicates the peak quota amount of paged pool usage for the process.
Example: 31'
DisplayName'Peak Paged Pool Usage Quota'
MappingStrings['Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|QuotaPeakPagedPoolUsage']
readTrue
QuotaPeakPagedPoolUsage property is in 1 class (Win32_Process) of ROOT\cimv2 and in 4 namespaces
ReadOperationCount property
CIMTYPE'uint64'
Description'The ReadOperationCount property specifies the number of read operations performed.'
DisplayName'Read Operation Count'
MappingStrings['Win32API|Process and Thread Structures|SYSTEM_PROCESS_INFORMATION|ReadOperationCount']
readTrue
ReadOperationCount property is in 2 classes of ROOT\cimv2 and in 2 namespaces
ReadTransferCount property
CIMTYPE'uint64'
Description'The ReadTransferCount property specifies the amount of data read.'
DisplayName'Read Transfer Count'
MappingStrings['Win32API|Process and Thread Structures|SYSTEM_PROCESS_INFORMATION|ReadTransferCount']
readTrue
Units'bytes'
ReadTransferCount property is in 2 classes of ROOT\cimv2 and in 2 namespaces
SessionId property
CIMTYPE'uint32'
Description'The SessionId property specifies the unique identifier that is generated by the operating system when the session is created. A session spans a period of time from log in to log out on a particular system.'
DisplayName'Session Id'
MappingStrings['Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|SessionId']
readTrue
SessionId property is in 7 classes of ROOT\cimv2 and in 16 namespaces
ThreadCount property
CIMTYPE'uint32'
Description'The ThreadCount property specifies the number of active threads in this process. An instruction is the basic unit of execution in a processor, and a thread is the object that executes instructions. Every running process has at least one thread. This property is for computers running Windows NT only.'
DisplayName'Thread Count'
MappingStrings['Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|NumberOfThreads']
readTrue
ThreadCount property is in 7 classes of ROOT\cimv2 and in 3 namespaces
VirtualSize property
CIMTYPE'uint64'
Description'The VirtualSize property specifies the current size in bytes of the virtual address space the process is using. Use of virtual address space does not necessarily imply corresponding use of either disk or main memory pages. Virtual space is finite, and by using too much, the process can limit its ability to load libraries.'
DisplayName'Virtual Address Space Usage'
MappingStrings['Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|VirtualSize']
readTrue
Units'bytes'
VirtualSize property is in 1 class (Win32_Process) of ROOT\cimv2 and in 4 namespaces
WindowsVersion property
CIMTYPE'string'
Description'The WindowsVersion property indicates the version of Windows in which the process is running.
Example: 4.0'
DisplayName'Windows Version'
MappingStrings['Win32API|Process and Thread Functions|GetProcessVersion']
readTrue
WindowsVersion property is in 1 class (Win32_Process) of ROOT\cimv2 and in 8 namespaces
WriteOperationCount property
CIMTYPE'uint64'
Description'The WriteOperationCount property specifies the number of write operations performed.'
DisplayName'Write Operation Count'
MappingStrings['Win32API|Process and Thread Structures|SYSTEM_PROCESS_INFORMATION|WriteOperationCount']
readTrue
WriteOperationCount property is in 2 classes of ROOT\cimv2 and in 2 namespaces
WriteTransferCount property
CIMTYPE'uint64'
Description'The WriteTransferCount property specifies the amount of data written.'
DisplayName'Write Transfer Count'
MappingStrings['Win32API|Process and Thread Structures|SYSTEM_PROCESS_INFORMATION|WriteTransferCount']
readTrue
Units'bytes'
WriteTransferCount property is in 2 classes of ROOT\cimv2 and in 2 namespaces

Derived properties (18) of Win32_Process class

Caption property
CIMTYPE'string'
Description'The Caption property is a short textual description (one-line string) of the object.'
MaxLen64
readTrue
Caption property is in 1050 classes of ROOT\cimv2 and in 37 namespaces
CreationClassName property
CIM_KeyTrue
CIMTYPE'string'
Description'CreationClassName indicates the name of the class or the subclass used in the creation of an instance. When used with the other key properties of this class, this property allows all instances of this class and its subclasses to be uniquely identified.'
MaxLen256
readTrue
CreationClassName property is in 178 classes of ROOT\cimv2 and in 20 namespaces
CreationDate property
CIMTYPE'datetime'
Description'Time that the process began executing.'
FixedTrue
readTrue
CreationDate property is in 11 classes of ROOT\cimv2 and in 4 namespaces
CSCreationClassName property
CIM_KeyTrue
CIMTYPE'string'
Description'CSCreationClassName contains the scoping computer system's creation class name.'
MaxLen256
Propagated'CIM_OperatingSystem.CSCreationClassName'
readTrue
CSCreationClassName property is in 27 classes of ROOT\cimv2 and in 2 namespaces
CSName property
CIM_KeyTrue
CIMTYPE'string'
Description'The scoping computer system's name.'
MaxLen256
Propagated'CIM_OperatingSystem.CSName'
readTrue
CSName property is in 28 classes of ROOT\cimv2 and in 2 namespaces
Description property
CIMTYPE'string'
Description'The Description property provides a textual description of the object. '
readTrue
Description property is in 1061 classes of ROOT\cimv2 and in 142 namespaces
ExecutionState property
CIMTYPE'uint16'
Description'Indicates the current operating condition of the process. Values include ready (2), running (3), and blocked (4), among others.'
readTrue
Values['Unknown', 'Other', 'Ready', 'Running', 'Blocked', 'Suspended Blocked', 'Suspended Ready', 'Terminated', 'Stopped', 'Growing']
ExecutionState property is in 4 classes of ROOT\cimv2 and in 2 namespaces
Handle property
CIMTYPE'string'
Description'A string used to identify the process. A process ID is a kind of process handle.'
keyTrue
MaxLen256
readTrue
Handle property is in 4 classes of ROOT\cimv2 and in 4 namespaces
InstallDate property
CIMTYPE'datetime'
Description'The InstallDate property is datetime value indicating when the object was installed. A lack of a value does not indicate that the object is not installed.'
MappingStrings['MIF.DMTF|ComponentID|001.5']
readTrue
InstallDate property is in 227 classes of ROOT\cimv2 and in 23 namespaces
KernelModeTime property
CIMTYPE'uint64'
Description'Time in kernel mode, in 100 nanoseconds. If this information is not available, a value of 0 should be used.'
Override'KernelModeTime'
readTrue
Units'100 nanoseconds'
KernelModeTime property is in 4 classes of ROOT\cimv2 and in 2 namespaces
Name property
CIMTYPE'string'
Description'The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.'
readTrue
Name property is in 1046 classes of ROOT\cimv2 and in 142 namespaces
OSCreationClassName property
CIM_KeyTrue
CIMTYPE'string'
Description'The scoping operating system's creation class name.'
MaxLen256
Propagated'CIM_OperatingSystem.CreationClassName'
readTrue
OSCreationClassName property is in 4 classes of ROOT\cimv2 and in 2 namespaces
OSName property
CIM_KeyTrue
CIMTYPE'string'
Description'The scoping operating system's name.'
MaxLen256
Propagated'CIM_OperatingSystem.Name'
readTrue
OSName property is in 4 classes of ROOT\cimv2 and in 3 namespaces
Priority property
CIMTYPE'uint32'
Description'The Priority property indicates the scheduling priority of the process within the operating system. The higher the value, the higher priority the process receives. Priority values can range from 0 (lowest priority) to 31 (highest priority).
Example: 7.'
DisplayName'Priority'
MappingStrings['Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|BasePriority']
Override'Priority'
readTrue
Priority property is in 9 classes of ROOT\cimv2 and in 31 namespaces
Status property
CIMTYPE'string'
Description'The Status property is a string indicating the current status of the object. Various operational and non-operational statuses can be defined. Operational statuses are "OK", "Degraded" and "Pred Fail". "Pred Fail" indicates that an element may be functioning properly but predicting a failure in the near future. An example is a SMART-enabled hard drive. Non-operational statuses can also be specified. These are "Error", "Starting", "Stopping" and "Service". The latter, "Service", could apply during mirror-resilvering of a disk, reload of a user permissions list, or other administrative work. Not all such work is on-line, yet the managed element is neither "OK" nor in one of the other states.'
MaxLen10
readTrue
ValueMap['OK', 'Error', 'Degraded', 'Unknown', 'Pred Fail', 'Starting', 'Stopping', 'Service', 'Stressed', 'NonRecover', 'No Contact', 'Lost Comm']
Values['OK', 'Error', 'Degraded', 'Unknown', 'Pred Fail', 'Starting', 'Stopping', 'Service', 'Stressed', 'NonRecover', 'No Contact', 'Lost Comm']
Status property is in 230 classes of ROOT\cimv2 and in 42 namespaces
TerminationDate property
CIMTYPE'datetime'
Description'Time that the process was stopped or terminated.'
readTrue
TerminationDate property is in 2 classes of ROOT\cimv2 and in 2 namespaces
UserModeTime property
CIMTYPE'uint64'
Description'Time in user mode, in 100 nanoseconds. If this information is not available, a value of 0 should be used.'
Override'UserModeTime'
readTrue
Units'100 nanoseconds'
UserModeTime property is in 4 classes of ROOT\cimv2 and in 2 namespaces
WorkingSetSize property
CIMTYPE'uint64'
Description'The amount of memory in bytes that a process needs to execute efficiently, for an operating system that uses page-based memory management. If an insufficient amount of memory is available (< working set size), thrashing will occur. If this information is not known, NULL or 0 should be entered. If this data is provided, it could be monitored to understand a process' changing memory requirements as execution proceeds.'
readTrue
Units'bytes'
WorkingSetSize property is in 2 classes of ROOT\cimv2 and in 4 namespaces

Win32_Process Qualifiers

NameValueToInstanceToSubclassOverridableAmendedLocal
CreateBy'Create'
DeleteBy'DeleteInstance'
Description'The Win32_Process class represents a sequence of events on a Win32 system. Any sequence consisting of the interaction of one or more processors or interpreters, some executable code, and a set of inputs, is a descendent (or member) of this class.
Example: A client application running on a Win32 system.'
DisplayName'Processes'
dynamicTrue
Locale1033
provider'CIMWin32'
SupportsCreateTrue
SupportsDeleteTrue
UUID'{8502C4DC-5FBB-11D2-AAC1-006008C78BC7}'

Win32_Process System properties

NameValueOriginCIMTypeLocalArray
__PATH'\\.\ROOT\cimv2:Win32_Process'___SYSTEM8
__NAMESPACE'ROOT\cimv2'___SYSTEM8
__SERVER'.'___SYSTEM8
__DERIVATION['CIM_Process', 'CIM_LogicalElement', 'CIM_ManagedSystemElement']___SYSTEM8
__PROPERTY_COUNT45___SYSTEM3
__RELPATH'Win32_Process'___SYSTEM8
__DYNASTY'CIM_ManagedSystemElement'___SYSTEM8
__SUPERCLASS'CIM_Process'___SYSTEM8
__CLASS'Win32_Process'___SYSTEM8
__GENUS1___SYSTEM3

Similar Classes to Win32_Process

Number of classes:40
Class nameChildsPropertiesMethodsClass
Instances
Child
Instances
AbstractSingleton
CIM_AssociatedProcessorMemory130-4-
CIM_OSProcess020---
CIM_Process1180-40-
CIM_ProcessExecutable06040---
CIM_Processor1302-1-
CIM_ProcessThread020---
Win32_AssociatedProcessorMemory0304---
Win32_ComputerSystemProcessor0201---
Win32_NamedJobObjectProcess0204---
Win32_PerfFormattedData_Counters_PerProcessorNetworkActivityCycles022040---
Win32_PerfFormattedData_Counters_PerProcessorNetworkInterfaceCardActivity030040---
Win32_PerfFormattedData_Counters_ProcessorInformation03706---
Win32_PerfFormattedData_HvStats_HyperVHypervisorLogicalProcessor03205---
Win32_PerfFormattedData_HvStats_HyperVHypervisorRootVirtualProcessor08405---
Win32_PerfFormattedData_HvStats_HyperVHypervisorVirtualProcessor0840----
Win32_PerfFormattedData_Lsa_SecurityPerProcessStatistics011040---
Win32_PerfFormattedData_NvspSwitchProcStats_HyperVVirtualSwitchProcessor01304---
Win32_PerfFormattedData_PerfOS_Processor02405---
Win32_PerfFormattedData_PerfProc_Process037040---
Win32_PerfFormattedData_PerfProc_ProcessAddressSpace_Costly046040---
Win32_PerfFormattedData_XTPDatabaseEngine_XTPPhantomProcessor0150----
Win32_PerfRawData_Counters_PerProcessorNetworkActivityCycles022040---
Win32_PerfRawData_Counters_PerProcessorNetworkInterfaceCardActivity030040---
Win32_PerfRawData_Counters_ProcessorInformation04106---
Win32_PerfRawData_HvStats_HyperVHypervisorLogicalProcessor03905---
Win32_PerfRawData_HvStats_HyperVHypervisorRootVirtualProcessor010505---
Win32_PerfRawData_HvStats_HyperVHypervisorVirtualProcessor01050----
Win32_PerfRawData_Lsa_SecurityPerProcessStatistics011040---
Win32_PerfRawData_NvspSwitchProcStats_HyperVVirtualSwitchProcessor01304---
Win32_PerfRawData_PerfOS_Processor02405---
Win32_PerfRawData_PerfProc_Process037040---
Win32_PerfRawData_PerfProc_ProcessAddressSpace_Costly046040---
Win32_PerfRawData_XTPDatabaseEngine_XTPPhantomProcessor0150----
Win32_Processor05121---
Win32_ProcessStartTrace070---
Win32_ProcessStartup0140---
Win32_ProcessStopTrace080---
Win32_ProcessTrace270---
Win32_SessionProcess02014---
Win32_SystemProcesses02040---
comments powered by Disqus
online utility - toplist
WUtils.com