Information
The topic you requested is included in another documentation set. For convenience, it's displayed below. Choose Switch to see the topic in its original location.

Win32_ProcessStopTrace class

The Win32_ProcessStopTrace event WMI class indicates that a process is terminated.

The following syntax is simplified from Managed Object Format (MOF) code, and includes all of the inherited properties.

Syntax

class Win32_ProcessStopTrace : Win32_ProcessTrace
{
  uint32 ExitStatus;
  uint4  PageDirectoryBase;
  uint32 ParentProcessID;
  uint32 ProcessID;
  string ProcessName;
  uint8  SECURITY_DESCRIPTOR[];
  uint32 SessionID;
  uint8  Sid[];
  uint8  TIME_CREATED;
};

Members

The Win32_ProcessStopTrace class has these types of members:

Properties

The Win32_ProcessStopTrace class has these properties.

ExitStatus
Data type: uint32
Access type: Read-only

Exit status of the stopped process.

Windows Server 2003:  ExitStatus is not available.

PageDirectoryBase
Data type: uint4
Access type: Read-only

Identifies the page directory base of the process.

ParentProcessID
Data type: uint32
Access type: Read-only

Starting with Windows Vista, the value of this property is always 0 (zero).

Windows Server 2003:  Process ID of the parent process of the process that starts an event.

This property is inherited from Win32_ProcessTrace.

ProcessID
Data type: uint32
Access type: Read-only

Process in an event. This property is inherited from Win32_ProcessTrace.

ProcessName
Data type: string
Access type: Read-only

Name of the process that stops. You can use this name to get the instance of Win32_Process for the same process.

SECURITY_DESCRIPTOR
Data type: uint8 array
Access type: Read-only

Descriptor used by the event provider to determine the users who can receive the event. This property is inherited from __Event.

Note  A NULL access control list (ACL) in the SECURITY_DESCRIPTOR grants unlimited access to everyone all of the time. For more information, see Creating a Security Descriptor for a New Object.

SessionID
Data type: uint32
Access type: Read-only

Session under which the process exists.

Sid
Data type: uint8 array
Access type: Read-only

Security identifier (SID) of the user context under which the event happens. This property is inherited from Win32_ProcessTrace.

TIME_CREATED
Data type: uint8
Access type: Read-only

Unique value that indicates the time the event was generated. This property is inherited from __Event.

Remarks

The Win32_ProcessStopTrace class is derived from Win32_ProcessTrace.

Examples

The following VBScript code example creates a Notepad process on the local computer that reports when the process stops. Run the script and close the Notepad window when the script shows the "Waiting for process to stop..." message.


Const SW_NORMAL = 1
strComputer = "."
strCommand = "Notepad.exe" 
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" _
    & strComputer & "\root\cimv2")

Set objStartup = objWMIService.Get("Win32_ProcessStartup")
Set objConfig = objStartup.SpawnInstance_

objConfig.ShowWindow = SW_NORMAL
Set objProcess = objWMIService.Get("Win32_Process")
intReturn = objProcess.Create _
    (strCommand, Null, objConfig, intProcessID)
If intReturn <> 0 Then
    Wscript.Echo "Process could not be created." & _
        vbNewLine & "Command line: " & strCommand & _
        vbNewLine & "Return value: " & intReturn
Else
    Wscript.Echo "Process created." & _
        vbNewLine & "Command line: " & strCommand & _
        vbNewLine & "Process ID: " & intProcessID    
    Set colProcessStopTrace = objWMIService.ExecNotificationQuery _
        ("SELECT * FROM Win32_ProcessStopTrace")
        WScript.Echo "Waiting for process to stop ..."
    Do
        Set objLatestEvent = colProcessStopTrace.NextEvent
        If objLatestEvent.ProcessId = intProcessID Then
            Wscript.Echo "StoppedProcess Name: " _
                & objLatestEvent.ProcessName
            Wscript.Echo "Process ID: " & objLatestEvent.ProcessId
            WScript.Echo "Exit code: " & objLatestEvent.ExitStatus
    End If
  Loop
End If

Requirements

Minimum supported client

Windows Vista

Minimum supported server

Windows Server 2003

Namespace

\root\CIMV2

MOF

Krnlprov.mof

DLL

Krnlprov.dll

See also

Operating System Classes
Win32_Process

 

 

Show:
© 2014 Microsoft