Win32_Thread class

The Win32_ThreadWMI class represents a thread of execution. While a process must have one thread of execution, the process can create other threads to execute tasks in parallel. Threads share the process environment, thus multiple threads under the same process use less memory than the same number of processes.

The following syntax is simplified from Managed Object Format (MOF) code and includes all of the inherited properties. Properties and methods are in alphabetic order, not MOF order.

Syntax

[Provider("CIMWin32")]class Win32_Thread : CIM_Thread
{
  string   Caption;
  string   CreationClassName;
  string   CSCreationClassName;
  string   CSName;
  string   Description;
  uint64   ElapsedTime;
  uint16   ExecutionState;
  string   Handle;
  datetime InstallDate;
  uint64   KernelModeTime;
  string   Name;
  string   OSCreationClassName;
  string   OSName;
  uint32   Priority;
  uint32   PriorityBase;
  string   ProcessCreationClassName;
  string   ProcessHandle;
  uint32   StartAddress;
  string   Status;
  uint32   ThreadState;
  uint32   ThreadWaitReason;
  uint64   UserModeTime;
};

Members

The Win32_Thread class has these types of members:

Properties

The Win32_Thread class has these properties.

Caption
Data type: string
Access type: Read-only
Qualifiers: MaxLen (64)

Short description of the object.

CreationClassName
Data type: string
Access type: Read-only
Qualifiers: Key, MaxLen (256)

Name of the first concrete class to appear in the inheritance chain used in the creation of an instance. When used with the other key properties of the class, this property allows all instances of this class and its subclasses to be uniquely identified.

CSCreationClassName
Data type: string
Access type: Read-only
Qualifiers: Key, MaxLen (256)

Creation class name of the scoping computer system.

CSName
Data type: string
Access type: Read-only
Qualifiers: Key, MaxLen (256)

Name of the scoping computer system.

Description
Data type: string
Access type: Read-only

Description of the object.

ElapsedTime
Data type: uint64
Access type: Read-only
Qualifiers: Units (Milliseconds)

Total execution time, in milliseconds, given to this thread since its creation.

For more information about using uint64 values in scripts, see Scripting in WMI.

ExecutionState
Data type: uint16
Access type: Read-only

Current operating condition of the thread.

ValueMeaning
0

Unknown

1

Other

2

Ready

3

Running

4

Blocked

5

Suspended Blocked

6

Suspended Ready

 

Handle
Data type: string
Access type: Read-only
Qualifiers: MaxLen (256)

Handle to a thread. The handle has full access rights by default. With the correct security access, the handle can be used in any function that accepts a thread handle. Depending on the inheritance flag specified when it is created, this handle can be inherited by child processes.

InstallDate
Data type: datetime
Access type: Read-only

Object was installed. This property does not need a value to indicate that the object is installed.

KernelModeTime
Data type: uint64
Access type: Read-only

Time in kernel mode, in 100 nanosecond units. If this information is not available, a value of 0 (zero) should be used.

For more information about using uint64 values in scripts, see Scripting in WMI.

Name
Data type: string
Access type: Read-only

Label by which the object is known. When subclassed, the property can be overridden to be a key property.

OSCreationClassName
Data type: string
Access type: Read-only

Creation class name of the scoping operating system.

OSName
Data type: string
Access type: Read-only
Qualifiers: Key, MaxLen (256)

Name of the scoping operating system.

Priority
Data type: uint32
Access type: Read-only

Dynamic priority of the thread. Each thread has a dynamic priority that the scheduler uses to determine which thread to execute. Initially, a thread's dynamic priority is the same as its base priority. The system can raise and lower the dynamic priority, to ensure that it is responsive (guaranteeing that no threads are starved for processor time). The system does not boost the priority of threads with a base priority level between 16 and 31. Only threads with a base priority between 0 and 15 receive dynamic priority boosts. Higher numbers indicate higher priorities.

PriorityBase
Data type: uint32
Access type: Read-only

Current base priority of a thread. The operating system may raise the thread's dynamic priority above the base priority if the thread is handling user input, or lower it toward the base priority if the thread becomes compute-bound. The PriorityBase property can have a value between 0 and 31.

ProcessCreationClassName
Data type: string
Access type: Read-only
Qualifiers: Key, MaxLen (256)

Value of the scoping process CreationClassName property.

ProcessHandle
Data type: string
Access type: Read-only
Qualifiers: MaxLen (256)

Process that created the thread. The contents of this property can be used by Windows application programming interface (API) elements.

StartAddress
Data type: uint32
Access type: Read-only

Starting address of the thread. Because any application with appropriate access to the thread can change the thread's context, this value may only be an approximation of the thread's starting address.

Status
Data type: string
Access type: Read-only
Qualifiers: MaxLen (10)

Current status of the object. Various operational and nonoperational statuses can be defined. Operational statuses include: "OK", "Degraded", and "Pred Fail" (an element, such as a SMART-enabled hard disk drive, may be functioning properly but predicting a failure in the near future). Nonoperational statuses include: "Error", "Starting", "Stopping", and "Service". The latter, "Service", could apply during mirror-resilvering of a disk, reload of a user permissions list, or other administrative work. Not all such work is online, yet the managed element is neither "OK" nor in one of the other states.

The values are:

"OK"
"Error"
"Degraded"
"Unknown"
"Pred Fail"
"Starting"
"Stopping"
"Service"
ThreadState
Data type: uint32
Access type: Read-only

Current execution state for the thread.

ValueMeaning
0

Initialized — It is recognized by the microkernel.

1

Ready — It is prepared to run on the next available processor.

2

Running — It is executing.

3

Standby — It is about to run, only one thread may be in this state at a time.

4

Terminated — It is finished executing.

5

Waiting — It is not ready for the processor, when ready, it will be rescheduled.

6

Transition — The thread is waiting for resources other than the processor,

7

Unknown — The thread state is unknown.

 

ThreadWaitReason
Data type: uint32
Access type: Read-only

Reason why the thread is waiting. This value is only valid if the ThreadState member is set to Transition (6). Event pairs allow communication with protected subsystems.

ValueMeaning
0

Executive

1

FreePage

2

PageIn

3

PoolAllocation

4

ExecutionDelay

5

FreePage

6

PageIn

7

Executive

8

FreePage

9

PageIn

10

PoolAllocation

11

ExecutionDelay

12

FreePage

13

PageIn

14

EventPairHigh

15

EventPairLow

16

LPCReceive

17

LPCReply

18

VirtualMemory

19

PageOut

20

Unknown

 

UserModeTime
Data type: uint64
Access type: Read-only

Time in user mode, in 100 nanoseconds units. If this information is not available, a value of 0 (zero) should be used.

For more information about using uint64 values in scripts, see Scripting in WMI.

Remarks

The Win32_Thread class is derived from CIM_Thread.

Overview

For routine day-to-day monitoring, there is usually little reason to have a detailed list of threads and their associated properties. Computers create and delete thousands of threads during the course of a day, and few of these creations or deletions are meaningful to anyone but the developer who wrote the software.

However, when you are troubleshooting problems with an application, tracking the individual threads for a process allows you to identify when threads are created and when (or if) they are destroyed. Because threads that are created but not destroyed cause memory leaks, tracking individual threads can be useful information for support technicians. Likewise, identifying thread priorities can help pinpoint threads that, by running at an abnormally high priority, are preempting CPU cycles needed by other threads and other processes.

Using Win32_Thread

As implied in the preceding syntax block, the Win32_Thread class does not report the name of the process under which each thread runs. Instead, it reports the ID of the process under which the thread runs. To return the name of a process and a list of all its threads, your script must:

  1. Connect to the Win32_Process class and return the list of processes and their process IDs.
  2. Temporarily store this information in an array or Dictionary object.
  3. For each process ID, return the list of threads for that process, and then display the process name and the list of threads.

Examples

The following VBScript sample monitors the threads running on a computer.

Set objDictionary = CreateObject("Scripting.Dictionary")
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
 & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colProcesses = objWMIService.ExecQuery _
 ("SELECT * FROM Win32_Process")
For Each objProcess in colProcesses
 objDictionary.Add objProcess.ProcessID, objProcess.Name
Next
Set colThreads = objWMIService.ExecQuery _
 ("SELECT * FROM Win32_Thread")
For Each objThread in colThreads
 intProcessID = CInt(objThread.ProcessHandle)
 strProcessName = objDictionary.Item(intProcessID)
 Wscript.Echo strProcessName & VbTab & objThread.ProcessHandle & _
 VbTab & objThread.Handle & VbTab & objThread.ThreadState
Next

Requirements

Minimum supported client

Windows Vista

Minimum supported server

Windows Server 2003

Namespace

\root\CIMV2

MOF

CIMWin32.mof

DLL

CIMWin32.dll

See also

Operating System Classes

 

 

Show:
© 2014 Microsoft