ListRunningScripts.vbs

'=========================================================================
' ListRunningScripts.vbs
' VERSION: 1.1 - Null value is returned when a script is launched by another user on the local computer and the script is not elevated for UAC. I added a check to look for this and alert the user.
' AUTHOR: Brian Steinmeyer
' EMAIL: [email protected]
' WEB: https://sigkillit.com
' DATE: 12/21/2012
' COMPATIBLE: Windows XP, Server 2003, and Above
' COMMENTS: If you ever had a wscript.exe or cscript.exe process running but
' need to know the exact script it is running you can find the answer using
' the CommandLine property in the WIN32_Process Class. You can view this
' property in Task Manager by clicking View->Choose Columns. Alternatively,
' you can script it as I have below. The script works on the local computer
' as well as remote computers. Set the computer to run the script against
' and optionally set it to show the Scripting Host that launched the script.
' EXAMPLE: List Running Scripts on Local Computer Without Script Host
'          Dim strComputer: strComputer = "."
'          Dim blnShowScriptHost: blnShowScriptHost = False
' EXAMPLE: List Running Scripts on Local Computer With Script Host
'          Dim strComputer: strComputer = "."
'          Dim blnShowScriptHost: blnShowScriptHost = True
' EXAMPLE: List Running Scripts on Remote Computer Without Script Host
'          Dim strComputer: strComputer = "server"
'          Dim blnShowScriptHost: blnShowScriptHost = False
' EXAMPLE: List Running Scripts on Remote Computer With Script Host
'          Dim strComputer: strComputer = "server"
'          Dim blnShowScriptHost: blnShowScriptHost = True
'=========================================================================
Option Explicit
' ------ SCRIPT CONFIGURATION ------
Dim strComputer: strComputer = "."
Dim blnShowScriptHost: blnShowScriptHost = False
' ------ END CONFIGURATION ------

Wscript.Echo ListRunningScripts(strComputer)

Private Function ListRunningScripts(strComputer)

    On Error Resume Next

    Dim objWMIService: Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
    Dim colProcesses: Set colProcesses = objWMIService.ExecQuery("SELECT * FROM Win32_Process WHERE Name = " & "'Wscript.exe' OR Name = 'Cscript.exe'")
    Dim objProcess
    Dim strResult: strResult = ""
    Dim count: count = 0
    If Not colProcesses.Count = 0 Then
        For Each objProcess in colProcesses
            count = count + 1
            If blnShowScriptHost = True Then
                strResult = strResult & objProcess.CommandLine & vbCrLf
            Else
                If IsNull(objProcess.CommandLine) OR IsNull(objProcess.ExecutablePath) Then
                    strResult = strResult & "NULL (You need to use Run As Administrator)" & vbCrLf
                Else
                    strResult = strResult & Trim(Replace(Replace(objProcess.CommandLine, objProcess.ExecutablePath, "", 1, 1, 1), objProcess.Name, 1, 1, 1)) & vbCrLf
                End If
            End If
        Next
    End If

    strResult = count & " Scripts are running" & vbCrLf & "----------------------" & vbCrLf & strResult

    If Err.Number <> 0 Then
        Err.Clear
        strResult = "!~ERROR~!"
    End If

    ListRunningScripts = strResult

    On Error Goto 0

End Function

 

4 comments

Skip to comment form

    • Natalie on January 24, 2013 at 6:32 pm

    Great script! I’d love to use it but when I have a script running under a different account at the same time, the script gives an error message. Any way to limit the scripts listed/seen to just those running under the same account as the one that ran this?

      • admin on January 25, 2013 at 2:33 am
        Author

      Very interesting, It appears certain properties of the win32_process class are returning as null if they are running as a different user on a local machine. I’m looking for a proper fix to this, but I have modified the script to handle this issue in the mean time

    • Natalie on January 25, 2013 at 2:03 pm

    Thanks for the fast workaround, Brian. 🙂 I’m making a throttling sub/function, and the logic in your script to identify the script filename running is absolute key to making it work properly. Awesome – thanks!!

    FWIW, I noticed this script no longer gives scripts running under different creds, which works great for me.

      • admin on January 26, 2013 at 2:37 am
        Author

      The issue is due to the script not running elevated as an administrator because of UAC. Since it is not running as an administrator, it does not have access to the CommandLine property of the WIN32_Process class, and returns the default value of NULL. You will not see this issue on a remote computer because you need to be an administrator on it and RPC is running it elevated. I’m doing a slight update on the script, which will note that to run it elevated. You can resolve the issue by opening a command prompt using “Run as Administrator”, and launch the script from the command line. In addition, I just put together this script which will launch scripts with elevated permissions. There are some other options on running the scripts with elevated permissions, which I just outlined in an article because of this post (https://sigkillit.com/2013/01/26/running-vbscripts-with-uac-elevation/) Thanks

Comments have been disabled.