process creation date using pid 2

[newbieScripter]

Greetings,

I was wondering if anyone knows how to get the creation date of a process using it's pid? My current script reads something like:

Set fso = CreateObject("Scripting.FileSystemObject")
Set file = fso.CreateTextFile(dataFilePath, True)
file.WriteLine(primaryApp.ProcessID)

' for the next line, I would like to do something like
file.WriteLine(primaryApp.CreationDate)


In linux the creation date of a process can be obtained doing something like:
ls -ld /proc/$pid


Anyone have any ideas for vbscripts? I've heard of something called WMI (windows management instrumentation), that supports a creation date property, but from what I've read WMI has to be downloaded and doesn't always come standard with Windows. I need something using strictly the standard VBS stuff that comes with windows. Any ideas, thanks.

 

[PHV]

something using strictly the standard VBS stuff
So, what is primaryApp ?

Hope This Helps, PH.
FAQ219-2884
FAQ181-2886

 

[newbieScripter]

Sorry bout that, primary app is the path to an executable. So it would read something like this:

Dim WshShell, primaryApp
Set WshShell = CreateObject("WScript.Shell")
Set primaryApp = WshShell.Exec(notepad.exe)

Set fso = CreateObject("Scripting.FileSystemObject")
Set file = fso.CreateTextFile(dataFilePath, True)
file.WriteLine(primaryApp.ProcessID)

' Now I just need to find out how to get the creation date of the process created from executing notepad.exe.

Thanks again

 

[strongm]

>I've read WMI has to be downloaded

Only if you are using old, obsolete versions of Windows. Everything since Windows 2000 SP2 has come with WMI included. And the older OSs will include it if they've had any .NET applications installed (or use Windows Update)

Here's one example of getting the creation date from WMI (assumes that primaryApp.ProcessID exists):

[blue]Dim objWMIService, myItem

Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\.\root\cimv2")

For Each myItem In objWMIService.ExecQuery("Select * from Win32_Process where ProcessID = " & primaryApp.ProcessID) ' We'll get 0 or 1 entry ...
    MsgBox myItem.creationdate ' yyyymmddhhnnss
Next[/blue]

 

[newbieScripter]

Thanks, guys

 

[newbieScripter]

Correct me if I'm wrong but I could probably modify the sql query to look something like:

Dim objWMIService, createDate
Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\.\root\cimv2")

createDate = objWMIService.ExecQuery("Select CreationDate from Win32_Process where ProcessID = " & primaryApp.ProcessID)

 

[PHV]

No, you can't.

 

[newbieScripter]

Cool, I've got it outputting the date now. One last question, do you know what value this is following the decimal point?

20090415135200.765461-240

 

[strongm]

first 6 digits after the decimal represent microseconds (however, do not assume that this field is accurate the apparant level of significance under Windows), and after that you get how many minutes (plus or minus) you are from GMT ... sorry ... UCT

 

[newbieScripter]

While we are on the subject, I needed to scroll through every process in the system so that I can check to see if their parent process id's match my current pid. That way I can kill it. Will the following query return a list of all the processes for WMI? Thanks

For Each colItem In objWMIService.ExecQuery("Select * from Win32_Process",,48)
if colItem.ParentProcessId = pid then
' kill the process

 

[strongm]

More or less, yes.

 

[newbieScripter]

Perfect, thanks again