11

I need to get the exact location of a process name that a scheduled job is executing. I want to use WMIC JOB (if you have any other suggestions.. let me know) to get that, but I don't know HOW exactly. I've tried several variations but no luck so far.

How should I?

  • Of course I tried, it's just that WMIC is a huge subject and I don't know what to do with it exactly. :) –  Dec 20 '11 at 16:36

3 Answers3

15

The following will work, though you only need "CommandLine" or "ExecutablePath" - not both:

wmic process where "ProcessID=1111" get CommandLine, ExecutablePath

It will return something like the following, showing where the program for PID 1111 is running:

"C:\Program Files (x86)\Common Files\MyProgram\Agent\agent.exe"
Lizz
  • 1,442
  • 5
  • 25
  • 51
6

Here is something to begin.

Get the process identifier of the service Schedule

wmic service where name='schedule' get ProcessId
ProcessId
288

Get the process which parent process identifier is the Schedule service

wmic process where ParentProcessId=288

Edited

I don't think that in Microsoft system jobs are what you are looking for :

A job object allows groups of processes to be managed as a unit. Job objects are namable, securable, shareable objects that control attributes of the processes associated with them. Operations performed on a job object affect all processes associated with the job object. Examples include enforcing limits such as working set size and process priority or terminating all processes associated with a job.

I think you are looking for process.

To answer your question I look for the processes started by the schedule service. If you want the exact location, it's given by the property ExecutablePath.

wmic process where ParentProcessId=288 get ExecutablePath
ExecutablePath
C:\Windows\system32\wuauclt.exe
JPBlanc
  • 70,406
  • 17
  • 130
  • 175
  • The unnecessary comments were removed. Those commands are related to how to get to Schedule service, not to the location of a process name (+process name). Am I missing somethig? Why did you use WMIC SERVICE / PROCESS and not JOB? Is that part of all of this? Thanks. –  Dec 20 '11 at 16:34
  • I see. But my point is **not necessary** to look for processes started by the schedule service. For example, if the schedule service is disabled, the code won't find all what I need. –  Dec 21 '11 at 10:20
  • I've got some code to do what I need, but it's not short as WMIC (JOB or whatever) can be, and that's why I search for alternative(s). –  Dec 21 '11 at 10:22
  • I thought about something in this direction- `WMIC job "TaskName" get command`. Something like that. Thanks again. –  Dec 21 '11 at 10:26
  • I modify my answer about Job. – JPBlanc Dec 26 '11 at 10:53
  • What does it mean in the buttom line? –  Dec 26 '11 at 21:25
  • 1
    Agreed. But I tried >< long time ago, but I tried alot of variations. I'll try again soon. In the meantime, if you have some ideas- let me know them. –  Jan 25 '12 at 14:04
  • OK. Problem is not solved, and it can't be unfortunately. You can lock this thread. Thanks for everyone :) –  Feb 06 '12 at 18:15
-2

WMIC has a progressive help built-in, so you can learn its syntax using /? at any place

C:\WINDOWS\system32>wmic
wmic:root\cli>/?

[global switches] <command>
Andrew
  • 1,858
  • 13
  • 15
Arky
  • 1
  • 2