2

Here is how I'm getting the "process created event" from:

System.Management.ManagementBaseObject WaitForNextEvent()

ManagementBaseObject e = watcher.WaitForNextEvent();

I require the:

  1. Window Title
  2. Caption (editor's note: I think Window Title and Caption are the same)
  3. Session Id
  4. Process Id
  5. Process Id (Parent)

What I have right now:

ManagementBaseObject e = watcher.WaitForNextEvent();

detail = new string[]
{
  ((e["TargetInstance"])["Caption"]).ToString(),
  ((e["TargetInstance"])["ProcessID"]).ToString(),
  ((e["TargetInstance"])["SessionId"]).ToString()
};

I got 3 of 5, but how can I get:

  • Window Title
  • Process Id (Parent)

Hint: You might be able to use the Process Id to find the missing fields.

JohnB
  • 18,046
  • 16
  • 98
  • 110
north start
  • 71
  • 1
  • 9
  • Linking the similar question. http://stackoverflow.com/questions/37586870/detect-the-win-gui-process-that-starts-in-windows-using-cmanagementeventwatche – Rahul Nikate Jun 09 '16 at 06:12
  • What is the actual problem you are having? – Remy Lebeau Jun 21 '16 at 23:43
  • @Remy Lebeau: He's trying to obtain the *"Window Title"* and *"Parent Process Id"*. – JohnB Dec 10 '19 at 18:47
  • @JohnB I'm aware of that, that is clearly stated in the question. What I meant was, WHY does the OP need those fields, and what problem is the OP having in getting them? The OP can enumerate the `e.Properties` and `e["TargetInstance"].Properties` collections to find out what values are actually available. Assuming the `TargetInstance` is a [`Win32_Process`](https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-process), it has `Caption`, `ProcessId`, and `ParentProcessId` properties... – Remy Lebeau Dec 10 '19 at 21:13
  • @JohnB ... though the `Caption` may be empty at the time the process is created, since a UI may not have been created yet. The Win32 [`EnumWindows()`](https://docs.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-enumwindows) and [`GetWindowThreadProcessId()`](https://docs.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-getwindowthreadprocessid) functions can be used to find windows that belong to a given process ID, and then [`GetWindowText()`](https://docs.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-getwindowtextw) can get the title/caption of those windows. – Remy Lebeau Dec 10 '19 at 21:15

0 Answers0