BACK TO INDEX

Win32_Process
The Win32_Process class represents a sequence of events on a Win32 system. Any sequence consisting of the interaction of one or more processors or interpreters, some executable code, and a set of inputs, is a descendent (or member) of this class. Example: A client application running on a Win32 system.
NameSpace Path
\ROOT\CIMV2\SMS
PROPERTYSMS_REPORTCIMTYPEDESCRIPTION
CaptionStringThe Caption property is a short textual description (one-line string) of the object.
CommandLineStringThe CommandLine property specifies the command line used to start a particular process, if applicable.
CreationClassNameStringCreationClassName indicates the name of the class or the subclass used in the creation of an instance. When used with the other key properties of this class, this property allows all instances of this class and its subclasses to be uniquely identified.
CreationDateDateTimeTime that the process began executing.
CSCreationClassNameStringCSCreationClassName contains the scoping computer system's creation class name.
CSNameStringThe scoping computer system's name.
DescriptionStringThe Description property provides a textual description of the object.
ExecutablePathStringThe ExecutablePath property indicates the path to the executable file of the process. Example: C:\WINDOWS\EXPLORER.EXE
ExecutionStateUInt16Indicates the current operating condition of the process. Values include ready (2), running (3), and blocked (4), among others.
HandleStringA string used to identify the process. A process ID is a kind of process handle.
HandleCountUInt32The HandleCount property specifies the total number of handles currently open by this process. This number is the sum of the handles currently open by each thread in this process. A handle is used to examine or modify the system resources. Each handle has an entry in an internally maintained table. These entries contain the addresses of the resources and the means to identify the resource type.
InstallDateDateTimeThe InstallDate property is datetime value indicating when the object was installed. A lack of a value does not indicate that the object is not installed.
KernelModeTimeUInt64Time in kernel mode, in 100 nanoseconds. If this information is not available, a value of 0 should be used.
MaximumWorkingSetSizeUInt32The MaximumWorkingSetSize property indicates the maximum working set size of the process. The working set of a process is the set of memory pages currently visible to the process in physical RAM. These pages are resident and available for an application to use without triggering a page fault. Example: 1413120.
MinimumWorkingSetSizeUInt32The MinimumWorkingSetSize property indicates the minimum working set size of the process. The working set of a process is the set of memory pages currently visible to the process in physical RAM. These pages are resident and available for an application to use without triggering a page fault. Example: 20480.
NameStringThe Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
OSCreationClassNameStringThe scoping operating system's creation class name.
OSNameStringThe scoping operating system's name.
OtherOperationCountUInt64The OtherOperationCount property specifies the number of I/O operations performed, other than read and write operations.
OtherTransferCountUInt64The OtherTransferCount property specifies the amount of data transferred during operations other than read and write operations.
PageFaultsUInt32The PageFaults property indicates the number of page faults generated by the process. Example: 10
PageFileUsageUInt32The PageFileUsage property indicates the amountof page file space currently being used by the process. Example: 102435
ParentProcessIdUInt32The ParentProcessId property specifies the unique identifier of the process that created this process. Process identifier numbers are reused, so they only identify a process for the lifetime of that process. It is possible that the process identified by ParentProcessId has terminated, so ParentProcessId may not refer to an running process. It is also possible that ParentProcessId incorrectly refers to a process which re-used that process identifier. The CreationDate property can be used to determine whether the specified parent was created after this process was created.
PeakPageFileUsageUInt32The PeakPageFileUsage property indicates the maximum amount of page file space used during the life of the process. Example: 102367
PeakVirtualSizeUInt64The PeakVirtualSize property specifies the maximum virtual address space the process has used at any one time. Use of virtual address space does not necessarily imply corresponding use of either disk or main memory pages. However, virtual space is finite, and by using too much, the process might limit its ability to load libraries.
PeakWorkingSetSizeUInt32The PeakWorkingSetSize property indicates the peak working set size of the process. Example: 1413120
PriorityUInt32The Priority property indicates the scheduling priority of the process within the operating system. The higher the value, the higher priority the process receives. Priority values can range from 0 (lowest priority) to 31 (highest priority). Example: 7.
PrivatePageCountUInt64The PrivatePageCount property specifies the current number of pages allocated that are accessible only to this process
ProcessIdUInt32The ProcessId property contains the global process identifier that can be used to identify a process. The value is valid from the creation of the process until the process is terminated.
QuotaNonPagedPoolUsageUInt32The QuotaNonPagedPoolUsage property indicates the quota amount of non-paged pool usage for the process. Example: 15
QuotaPagedPoolUsageUInt32The QuotaPagedPoolUsage property indicates the quota amount of paged pool usage for the process. Example: 22
QuotaPeakNonPagedPoolUsageUInt32The QuotaPeakNonPagedPoolUsage property indicates the peak quota amount of non-paged pool usage for the process. Example: 31
QuotaPeakPagedPoolUsageUInt32The QuotaPeakPagedPoolUsage property indicates the peak quota amount of paged pool usage for the process. Example: 31
ReadOperationCountUInt64The ReadOperationCount property specifies the number of read operations performed.
ReadTransferCountUInt64The ReadTransferCount property specifies the amount of data read.
SessionIdUInt32The SessionId property specifies the unique identifier that is generated by the operating system when the session is created. A session spans a period of time from log in to log out on a particular system.
StatusStringThe Status property is a string indicating the current status of the object. Various operational and non-operational statuses can be defined. Operational statuses are "OK", "Degraded" and "Pred Fail". "Pred Fail" indicates that an element may be functioning properly but predicting a failure in the near future. An example is a SMART-enabled hard drive. Non-operational statuses can also be specified. These are "Error", "Starting", "Stopping" and "Service". The latter, "Service", could apply during mirror-resilvering of a disk, reload of a user permissions list, or other administrative work. Not all such work is on-line, yet the managed element is neither "OK" nor in one of the other states.
TerminationDateDateTimeTime that the process was stopped or terminated.
ThreadCountUInt32The ThreadCount property specifies the number of active threads in this process. An instruction is the basic unit of execution in a processor, and a thread is the object that executes instructions. Every running process has at least one thread. This property is for computers running Windows NT only.
UserModeTimeUInt64Time in user mode, in 100 nanoseconds. If this information is not available, a value of 0 should be used.
VirtualSizeUInt64The VirtualSize property specifies the current size in bytes of the virtual address space the process is using. Use of virtual address space does not necessarily imply corresponding use of either disk or main memory pages. Virtual space is finite, and by using too much, the process can limit its ability to load libraries.
WindowsVersionStringThe WindowsVersion property indicates the version of Windows in which the process is running. Example: 4.0
WorkingSetSizeUInt64The amount of memory in bytes that a process needs to execute efficiently, for an operating system that uses page-based memory management. If an insufficient amount of memory is available (< working set size), thrashing will occur. If this information is not known, NULL or 0 should be entered. If this data is provided, it could be monitored to understand a process' changing memory requirements as execution proceeds.
WriteOperationCountUInt64The WriteOperationCount property specifies the number of write operations performed.
WriteTransferCountUInt64The WriteTransferCount property specifies the amount of data written.
SAMPLE DATA INSTANCE
   [LOCALE(1033): ToInstance Amended]
   instance of Win32_Process
   {
    Caption = "System Idle Process";
    CreationClassName = "Win32_Process";
    CSCreationClassName = "Win32_ComputerSystem";
    CSName = "SCCM01";
    Description = "System Idle Process";
    Handle = "0";
    HandleCount = 0;
    KernelModeTime = "6731438593750";
    Name = "System Idle Process";
    OSCreationClassName = "Win32_OperatingSystem";
    OSName = "Microsoft Windows Server 2003 R2 Standard Edition|C:\\WINDOWS|\\Device\\Harddisk0\\Partition1";
    OtherOperationCount = "0";
    OtherTransferCount = "0";
    PageFaults = 0;
    PageFileUsage = 0;
    ParentProcessId = 0;
    PeakPageFileUsage = 0;
    PeakVirtualSize = "0";
    PeakWorkingSetSize = 0;
    Priority = 0;
    PrivatePageCount = "0";
    ProcessId = 0;
    QuotaNonPagedPoolUsage = 0;
    QuotaPagedPoolUsage = 0;
    QuotaPeakNonPagedPoolUsage = 0;
    QuotaPeakPagedPoolUsage = 0;
    ReadOperationCount = "0";
    ReadTransferCount = "0";
    SessionId = 0;
    ThreadCount = 4;
    UserModeTime = "0";
    VirtualSize = "0";
    WindowsVersion = "5.2.3790";
    WorkingSetSize = "28672";
    WriteOperationCount = "0";
    WriteTransferCount = "0";
   };