Start Time, Run Duration & location of application by PID in Windows - windows

Question

Is there any Way to get Start Time(with date), total running time and location of a running application using its PID value under windows by using CMD or VBS? If so, how? thanks in advance.

Answer 1

You can query the Win32_Process WMI class with a VBScript to get the executable path and the start time of a process. The duration can be derived from the start time:
pid = 23
Set wmi = GetObject("winmgmts://./root/cimv2")
Set convert = CreateObject("WbemScripting.SWbemDateTime")
qry = "SELECT * FROM Win32_Process WHERE ProcessId = " & pid
For Each p In wmi.ExecQuery(qry)
If IsNull(p.CreationDate) Then
'leave start time and duration empty if CreationDate can't be read
startTime = ""
duration = ""
Else
'convert start time from a string yyyyMMddHHmmss.ffffff±zzz to a date
convert.Value = p.CreationDate
startTime = convert.GetVarDate(True)
'calculate duration in minutes
duration = DateDiff("n", startTime, Now)
End If
WScript.Echo startTime & vbTab & duration & vbTab & p.ExecutablePath
Next
Note that you need the SeDebugPrivilege privilege (administrators have it by default) to be able to see the executable path of the processes of other users. Without that privilege p.ExecutablePath will be Null for processes not running in the context of the current user.

Answer 2

Not as such (for time - path's available).
You can monitor process starts and exits and calculate it yourself.
So Tasklist /v gives you the command line which includes the path.
The same thing in VBS.
Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2")
Set colItems = objWMIService.ExecQuery("Select * From Win32_Process")
For Each objItem in colItems
msgbox objItem.ProcessID & " " & objItem.Caption
Next
This is a VBS script that monitors process starts and exits.
Set WshShell = WScript.CreateObject("WScript.Shell")
Set objWMIService = GetObject("winmgmts:\\.\root\CIMV2")
Set objEvents = objWMIService.ExecNotificationQuery _
("SELECT * FROM Win32_ProcessTrace")
Do
Set objReceivedEvent = objEvents.NextEvent
msgbox objReceivedEvent.ProcessName
Loop
No such thing as StartTime
class Win32_Process : CIM_Process
{
string Caption;
string CommandLine;
string CreationClassName;
datetime CreationDate;
string CSCreationClassName;
string CSName;
string Description;
string ExecutablePath;
uint16 ExecutionState;
string Handle;
uint32 HandleCount;
datetime InstallDate;
uint64 KernelModeTime;
uint32 MaximumWorkingSetSize;
uint32 MinimumWorkingSetSize;
string Name;
string OSCreationClassName;
string OSName;
uint64 OtherOperationCount;
uint64 OtherTransferCount;
uint32 PageFaults;
uint32 PageFileUsage;
uint32 ParentProcessId;
uint32 PeakPageFileUsage;
uint64 PeakVirtualSize;
uint32 PeakWorkingSetSize;
uint32 Priority;
uint64 PrivatePageCount;
uint32 ProcessId;
uint32 QuotaNonPagedPoolUsage;
uint32 QuotaPagedPoolUsage;
uint32 QuotaPeakNonPagedPoolUsage;
uint32 QuotaPeakPagedPoolUsage;
uint64 ReadOperationCount;
uint64 ReadTransferCount;
uint32 SessionId;
string Status;
datetime TerminationDate;
uint32 ThreadCount;
uint64 UserModeTime;
uint64 VirtualSize;
string WindowsVersion;
uint64 WorkingSetSize;
uint64 WriteOperationCount;
uint64 WriteTransferCount;
};