Click here to Skip to main content
13,900,419 members
Click here to Skip to main content
Add your own
alternative version


74 bookmarked
Posted 1 Nov 2005

Process Information and Notifications using WMI

, 1 Nov 2005
Rate this:
Please Sign up or sign in to vote.
An article on WMI.

Runing application listening to NotePad.exe life cycle


I have often needed information about a process running or wanted to know if it was running. Fortunately, the .NET framework comes with the System.Diagnostics namespace, which is providing very useful classes like Process to access all kinds of information about running processes. But what if the process is not running and you need to wait idle until it completes the startup? In this case you will need an event raised to you as soon as the process has been started. That is where WMI comes very handy. You can do everything that System.Diagnostics provides to you and a little bit more by using WMI.

Background (Windows.Management Namespace)

WMI is the Microsoft implementation of Web-Based Enterprise Management (WBEM), an industry initiative to develop a standard technology for accessing management information in an enterprise environment. This initiative helps companies lower their total cost of ownership by enabling powerful management of systems, applications and devices.

This namespace provides several classes. Some of them are used to query information about system resources like hard disk, network adaptor, Windows Service, Process, etc. I will use some of these classes to get the list of running processes. Querying the system can take some unnecessary time off your running thread, that’s when the other set of classes comes in handy. You can subscribe to some system resources to get notified when your requested action takes place. I will use these classes to subscribe for process instantiation and termination.

Using the code

This sample code is just the starting point to put you in the right direction and open a powerful technology. You can use the same techniques to query about the Windows system. If anything is running on your machine, like memory card, you can query to find it.

WQL = WMI Query Language

The WMI Query Language (WQL) is a subset of standard American National Standards Institute Structured Query Language (ANSI SQL) with minor semantic changes to support WMI.

An example of WQL which will result in a process list would look like this:

string queryString = "SELECT Name, ProcessId, Caption, ExecutablePath" +
                "  FROM Win32_Process";

A SelectQuery can be instantiated using that string or also like the following:

SelectQuery query = new SelectQuery(className, condition, selectedProperties);

Scope Object

The scope is like the database you are sending the query to. It mentions the machine name and then the schema and then the path to get to the resource. A local machine in Microsoft platform is usually referred to by a dot. Our example to get the list of processes on the local machine will look like the following:

ManagementScope scope = new System.Management.ManagementScope(@"\\.\root\CIMV2");

Searcher Object

Now that we have our two base classes, we can create the query using the searcher class and execute it by calling the Get() method which returns us a collection of management objects.

ManagementObjectSearcher searcher =
    new ManagementObjectSearcher(scope, query);
ManagementObjectCollection processes = searcher.Get();

Retrieving the detail

From here we can just iterate through the processes’ properties and get our information.

foreach (ManagementObject mo in processes)
    DataRow row = result.NewRow();
    row["Name"] = mo["Name"].ToString();
    row["ProcessId"] = Convert.ToInt32(mo["ProcessId"]);
    if (mo["Caption"]!= null)
        row["Caption"] = mo["Caption"].ToString();
    if (mo["ExecutablePath"]!= null)
        row["Path"] = mo["ExecutablePath"].ToString();
    result.Rows.Add( row );

Subscribing to an Event

So far we have just did a query to the system repository. Now the second part is even more interesting. Assume you are depending on a service running on a machine. Or you want to do an action when a service goes down. Or in this example find out when an application has been created (added to the process list).

All you need is a ManagementEventWatcher which has a delegate which you can subscribe to. It has methods like Start() and Stop() which launch a different thread. And similar to the searcher object, it works with a scope and a query.

string pol = "2";

string queryString =
    "SELECT *" +
    "  FROM __InstanceOperationEvent " +
    "WITHIN  " + pol +
    " WHERE TargetInstance ISA 'Win32_Process' "  +
    "   AND TargetInstance.Name = '" + appName + "'";

// You could replace the dot by a machine name to watch to that machine
string scope = @"\\.\root\CIMV2";

// create the watcher and start to listen
watcher = new ManagementEventWatcher(scope, queryString);
watcher.EventArrived +=
        new EventArrivedEventHandler(this.OnEventArrived);

All of this makes it possible for us to use this class easily to figure out what happens for a process like notepad.exe.

notePad = new ProcessInfo("notepad.exe");
notePad.Started +=
    new Win32Process.ProcessInfo.StartedEventHandler(this.NotepadStarted);
notePad.Terminated +=
    new Win32Process.ProcessInfo.TerminatedEventHandler(this.NotepadTerminated);


It is possible to call Set on the property values on the query and submit it. That is slightly more work but still very powerful.

Points of Interest

After I had installed WMI Server Explorer on my machine, I've got my Server Explorer on the Visual Studio extended to provide a very nice tool which tells me what the correct name for different resources is. And I was actually surprised at how many resources I can access now.


This article has no explicit license attached to it but may contain usage terms in the article text or the download files themselves. If in doubt please contact the author via the discussion board below.

A list of licenses authors might use can be found here


About the Author

Asghar Panahy
Systems Engineer
Netherlands Netherlands
I am a Microsoft certified application developer and work on Microsoft platform since 1993. I like to learn how Microsoft Systems have been built up and dig myself into different libraries in Win32 and .NET. I have worked with C++, VB6, Java, C#, ASP, ASP.Net and PHP.

You may also be interested in...


Comments and Discussions

QuestionUnsubscribing from WMI Watcher Pin
Onur Guzel8-Mar-18 3:04
memberOnur Guzel8-Mar-18 3:04 
QuestionDoes it work in windows 64 bit? Pin
The Mix20-Aug-16 14:58
memberThe Mix20-Aug-16 14:58 
Questionlicense? Pin
john_17269-May-14 10:28
memberjohn_17269-May-14 10:28 
Question"Cross-thread operation not valid: Control 'lblNotepad' accessed from a thread other than the thread it was created on." Pin
john_17269-May-14 9:37
memberjohn_17269-May-14 9:37 
QuestionWorks Great Pin
Anas Tamemy10-Apr-14 2:35
memberAnas Tamemy10-Apr-14 2:35 
QuestionMy vote of 5 Pin
m-h7-Sep-13 11:59
memberm-h7-Sep-13 11:59 
QuestionVery helpful article Pin
Mark Sutton9-Jun-13 20:40
memberMark Sutton9-Jun-13 20:40 
QuestionEnumerating Devices Used by Each Process? Pin
Darwin Airola31-May-13 15:38
memberDarwin Airola31-May-13 15:38 
QuestionAn attempt was made to reference a token that does not exist. Pin
Andy Lanng3-Mar-13 23:23
professionalAndy Lanng3-Mar-13 23:23 
GeneralGood Work Pin
YusufBelim7-Jan-10 1:05
memberYusufBelim7-Jan-10 1:05 
GeneralDoes not seem to notify on notepad in Win7 Pin
mpeebles28-Oct-09 7:52
membermpeebles28-Oct-09 7:52 
QuestionEvent on Any Process Pin
Michael Fritzius11-Feb-09 9:53
professionalMichael Fritzius11-Feb-09 9:53 
GeneralCross Thread Pin
waqarwaris10-Dec-08 22:53
memberwaqarwaris10-Dec-08 22:53 
GeneralRe: Cross Thread Pin
Asghar Panahy11-Dec-08 9:50
memberAsghar Panahy11-Dec-08 9:50 
GeneralInternet Connection Notification Pin
preeti sharma10-Sep-08 20:54
memberpreeti sharma10-Sep-08 20:54 
GeneralRe: Internet Connection Notification Pin
Asghar Panahy22-Sep-08 3:51
memberAsghar Panahy22-Sep-08 3:51 
Generalusing WMI Pin
kiquenet.com2-Apr-08 4:07
professionalkiquenet.com2-Apr-08 4:07 
GeneralRe: using WMI Pin
Asghar Panahy16-Oct-08 9:00
memberAsghar Panahy16-Oct-08 9:00 
GeneralWMI event notification occurs even when my processes is still running Pin
tompraison6-Jun-07 19:21
membertompraison6-Jun-07 19:21 
GeneralRe: WMI event notification occurs even when my processes is still running Pin
JoeRip15-Dec-07 14:06
memberJoeRip15-Dec-07 14:06 
QuestionSubscribed start/stop - get process info? Pin
jmbillings23-May-07 23:14
memberjmbillings23-May-07 23:14 
AnswerRe: Subscribed start/stop - get process info? [modified] Pin
Jan Stetka11-Apr-08 2:46
memberJan Stetka11-Apr-08 2:46 
GeneralIt does now quite work with VS2005 Pin
Ron4code10-May-07 20:17
memberRon4code10-May-07 20:17 
QuestionUser name and all processes Pin
Seishin#11-Jan-07 21:46
memberSeishin#11-Jan-07 21:46 
Questioncan this be done without .NET framework ? Pin
ravishankarkr15-Nov-06 2:12
memberravishankarkr15-Nov-06 2:12 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.

Permalink | Advertise | Privacy | Cookies | Terms of Use | Mobile
Web06 | 2.8.190306.1 | Last Updated 1 Nov 2005
Article Copyright 2005 by Asghar Panahy
Everything else Copyright © CodeProject, 1999-2019
Layout: fixed | fluid