This topic has not yet been rated - Rate this topic

Win32_ProcessStopTrace class

The Win32_ProcessStopTrace event WMI class indicates that a process is terminated.

The following syntax is simplified from Managed Object Format (MOF) code, and includes all of the inherited properties.

Syntax

class Win32_ProcessStopTrace : Win32_ProcessTrace
{
  uint32 ExitStatus;
  uint4  PageDirectoryBase;
  uint32 ParentProcessID;
  uint32 ProcessID;
  string ProcessName;
  uint8  SECURITY_DESCRIPTOR[];
  uint32 SessionID;
  uint8  Sid[];
  uint8  TIME_CREATED;
};

Members

The Win32_ProcessStopTrace class has these types of members:

Properties

Properties

The Win32_ProcessStopTrace class has these properties.

ExitStatus

Data type: uint32
Access type: Read-only

Exit status of the stopped process.

Windows Server 2003 and Windows XP: ExitStatus is not available.

PageDirectoryBase

Data type: uint4
Access type: Read-only

Identifies the page directory base of the process.

ParentProcessID

Data type: uint32
Access type: Read-only

Starting with Windows Vista, the value of this property is always 0 (zero).

Windows Server 2003 and Windows XP: Process ID of the parent process of the process that starts an event.

This property is inherited from Win32_ProcessTrace.

ProcessID

Data type: uint32
Access type: Read-only

Process in an event. This property is inherited from Win32_ProcessTrace.

ProcessName

Data type: string
Access type: Read-only

Name of the process that stops. You can use this name to get the instance of Win32_Process for the same process.

SECURITY_DESCRIPTOR

Data type: uint8 array
Access type: Read-only

Descriptor used by the event provider to determine the users who can receive the event. This property is inherited from __Event.

Note A NULL access control list (ACL) in the SECURITY_DESCRIPTOR grants unlimited access to everyone all of the time. For more information, see Creating a Security Descriptor for a New Object.

SessionID

Data type: uint32
Access type: Read-only

Session under which the process exists.

Sid

Data type: uint8 array
Access type: Read-only

Security identifier (SID) of the user context under which the event happens. This property is inherited from Win32_ProcessTrace.

TIME_CREATED

Data type: uint8
Access type: Read-only

Unique value that indicates the time the event was generated. This property is inherited from __Event.

Remarks

The Win32_ProcessStopTrace class is derived from Win32_ProcessTrace.

Examples

For script code examples, see WMI Tasks for Scripts and Applications and the TechNet ScriptCenter Script Repository.

For C++ code examples, see WMI C++ Application Examples.

The following VBScript code example creates a Notepad process on the local computer that reports when the process stops. Run the script and close the Notepad window when the script shows the "Waiting for process to stop..." message.

Windows 2000, Windows NT 4.0, Windows XP, and Windows Me/98/95: ExitStatus property is not available. To see complete script execution, you can comment out
WScript.Echo "Exit code: " & objLatestEvent.ExitStatus

Const SW_NORMAL = 1
strComputer = "."
strCommand = "Notepad.exe" 
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" _
    & strComputer & "\root\cimv2")

Set objStartup = objWMIService.Get("Win32_ProcessStartup")
Set objConfig = objStartup.SpawnInstance_

objConfig.ShowWindow = SW_NORMAL
Set objProcess = objWMIService.Get("Win32_Process")
intReturn = objProcess.Create _
    (strCommand, Null, objConfig, intProcessID)
If intReturn <> 0 Then
    Wscript.Echo "Process could not be created." & _
        vbNewLine & "Command line: " & strCommand & _
        vbNewLine & "Return value: " & intReturn
Else
    Wscript.Echo "Process created." & _
        vbNewLine & "Command line: " & strCommand & _
        vbNewLine & "Process ID: " & intProcessID    
    Set colProcessStopTrace = objWMIService.ExecNotificationQuery _
        ("SELECT * FROM Win32_ProcessStopTrace")
        WScript.Echo "Waiting for process to stop ..."
    Do
        Set objLatestEvent = colProcessStopTrace.NextEvent
        If objLatestEvent.ProcessId = intProcessID Then
            Wscript.Echo "StoppedProcess Name: " _
                & objLatestEvent.ProcessName
            Wscript.Echo "Process ID: " & objLatestEvent.ProcessId
            WScript.Echo "Exit code: " & objLatestEvent.ExitStatus
    End If
  Loop
End If

Requirements

Minimum supported client	Windows XP [desktop apps only]
Minimum supported server	Windows Server 2003 [desktop apps only]
Namespace	\root\CIMV2
MOF	Krnlprov.mof
DLL	Krnlprov.dll

Community Additions

ADD