Getting notified by a Windows process change in C# .NET

In this post we saw an example of using the ManagementEventWatcher object and and EventQuery query. The SQL-like query was used to subscribe to a WMI – Windows Management Instrumentation – level event, namely a change in the status of a Windows service. I won’t repeat the explanation here again concerning the techniques used. So if this is new to you then consult that post, the code is very similar.

In this post we’ll see how to get notified by the creation of a new Windows process. This can be as simple as starting up Notepad. A Windows process is represented by the Win32_Process WMI class which will be used in the query. We’ll take a slightly different approach and use the WqlEventQuery object which derives from EventQuery.

Consider the following code:

private static void RunManagementEventWatcherForWindowsProcess()
{
	WqlEventQuery processQuery = new WqlEventQuery("__InstanceCreationEvent", new TimeSpan(0, 0, 2), "targetinstance isa 'Win32_Process'");
	ManagementEventWatcher processWatcher = new ManagementEventWatcher(processQuery);
	processWatcher.Options.Timeout = new TimeSpan(0, 1, 0);
	Console.WriteLine("Open an application to trigger the event watcher.");
	ManagementBaseObject nextEvent = processWatcher.WaitForNextEvent();
	ManagementBaseObject targetInstance = ((ManagementBaseObject)nextEvent["targetinstance"]);
	PropertyDataCollection props = targetInstance.Properties;
	foreach (PropertyData prop in props)
	{
		Console.WriteLine("Property name: {0}, property value: {1}", prop.Name, prop.Value);
	}
	processWatcher.Stop();
}

In the Windows service example we used the following query:

SELECT * FROM __InstanceModificationEvent within 2 WHERE targetinstance isa ‘Win32_Service’

The WqlEventQuery constructor builds up a very similar statement. The TimeSpan refers to “within 2”, i.e. we want to be notified 2 seconds after the creation event. “targetinstance isa ‘Win32_Process'” corresponds to “WHERE targetinstance isa ‘Win32_Service'” of EventQuery.

Run this code and open an application. I got the following output for Notepad++:

…and this for IE:

You can view all posts related to Diagnostics here.

Finding all Windows Services using WMI in C# .NET

In this post we saw how to retrieve all logical drives using Windows Management Instrumentation – WMI -, and here how to find all network adapters.

Say you’d like to get a list of all Windows Services and their properties running on the local – “root” – machine, i.e. read the services listed here:

The following code will find all non-null properties of all Windows services found:

private static void ListAllWindowsServices()
{
	ManagementObjectSearcher windowsServicesSearcher = new ManagementObjectSearcher("root\\cimv2", "select * from Win32_Service");
	ManagementObjectCollection objectCollection = windowsServicesSearcher.Get();

	Console.WriteLine("There are {0} Windows services: ", objectCollection.Count);

	foreach (ManagementObject windowsService in objectCollection)
	{
		PropertyDataCollection serviceProperties = windowsService.Properties;
		foreach (PropertyData serviceProperty in serviceProperties)
		{
			if (serviceProperty.Value != null)
			{
				Console.WriteLine("Windows service property name: {0}", serviceProperty.Name);
				Console.WriteLine("Windows service property value: {0}", serviceProperty.Value);
			}
		}
		Console.WriteLine("---------------------------------------");
	}
}

At the time of writing this post I had 196 services running on my PC. Here’s an example of the output for the Adobe Flash Player Update service:

Once you know the property names of the WMI class then you can extend the SQL query. E.g. here’s how to find all non-running services:

ManagementObjectSearcher windowsServicesSearcher = new ManagementObjectSearcher("root\\cimv2", "select * from Win32_Service where Started = FALSE");

You can view all posts related to Diagnostics here.

Finding all network adapters using WMI in C# .NET

In this post we saw how to retrieve all logical drives using Windows Management Intrumentation (WMI). We’ll follow a very similar technique to enumerate all network adapters.

The following code prints all non-null properties of all network drives found on the local – “root” – computer:

private static void ListAllNetworkAdapters()
{
	ManagementObjectSearcher networkAdapterSearcher = new ManagementObjectSearcher("root\\cimv2", "select * from Win32_NetworkAdapterConfiguration");
	ManagementObjectCollection objectCollection = networkAdapterSearcher.Get();

	Console.WriteLine("There are {0} network adapaters: ", objectCollection.Count);

	foreach (ManagementObject networkAdapter in objectCollection)
	{
		PropertyDataCollection networkAdapterProperties = networkAdapter.Properties;
		foreach (PropertyData networkAdapterProperty in networkAdapterProperties)
		{
			if (networkAdapterProperty.Value != null)
			{
				Console.WriteLine("Network adapter property name: {0}", networkAdapterProperty.Name);
				Console.WriteLine("Network adapter property value: {0}", networkAdapterProperty.Value);
			}
		}
		Console.WriteLine("---------------------------------------");
	}
}

Here’s an extract of the printout from my PC:

You can view all posts related to Diagnostics here.

Finding all WMI class properties with .NET C#

In this post we saw how to enumerate all WMI – Windows Management Intrumentation – namespaces and classes. Then in this post we saw an example of querying the system to retrieve all local drives:

ObjectQuery objectQuery = new ObjectQuery("SELECT Size, Name FROM Win32_LogicalDisk where DriveType=3");

The properties that we’re after are like “Size” and “Name” of Win32_LogicalDisk. There’s a straightforward solution as we can select all properties in the object query. The following method will print all properties available in the WMI class, their types and values:

private static void PrintPropertiesOfWmiClass(string namespaceName, string wmiClassName)
{
	ManagementPath managementPath = new ManagementPath();
	managementPath.Path = namespaceName;
	ManagementScope managementScope = new ManagementScope(managementPath);
	ObjectQuery objectQuery = new ObjectQuery("SELECT * FROM " + wmiClassName);
	ManagementObjectSearcher objectSearcher = new ManagementObjectSearcher(managementScope, objectQuery);
	ManagementObjectCollection objectCollection = objectSearcher.Get();
	foreach (ManagementObject managementObject in objectCollection)
	{
		PropertyDataCollection props = managementObject.Properties;
		foreach (PropertyData prop in props)
		{
			Console.WriteLine("Property name: {0}", prop.Name);
			Console.WriteLine("Property type: {0}", prop.Type);
			Console.WriteLine("Property value: {0}", prop.Value);
		}
	}
}

You’ll need to run this with VS as an administrator. Also, there’s no authentication so we’ll use this code to investigate the class properties on the local machine. Otherwise see the posts referred to above for an example to read WMI objects from another machine on your network.

Let’s see what’s there for us in the cimv2/Win32_LocalTime class:

PrintPropertiesOfWmiClass("root\\cimv2", "Win32_LocalTime");

I got the following output:

Let’s see another one:

PrintPropertiesOfWmiClass("root\\cimv2", "Win32_BIOS");

Some interesting property values from the BIOS properties of my PC:

You can view all posts related to Diagnostics here.