Hey, Scripting Guy! How can I tell which scripts are running on a computer?

— NW

Hey, NW. This is a question we’re always a little reluctant to answer, because there’s a 50-50 chance you’ll be disappointed with what you hear. If you are running Windows 2000 (or a previous version of Windows), the answer is pretty straightforward: you can’t. A script such as this one – which looks for all processes running under Cscript.exe or Wscript.exe – can tell that scripts are running on a computer:

strComputer = “.”
Set objWMIService = GetObject(“winmgmts:” _
    & “{impersonationLevel=impersonate}!\\” & strComputer & “\root\cimv2”)
Set colItems = objWMIService.ExecQuery _
    (“Select * from Win32_Process Where Name = ‘cscript.exe'” & _
        ” OR Name = ‘wscript.exe'”)
For Each objItem in colItems
    Wscript.Echo objItem.Name
Next

However, this script can’t tell you the names of those scripts. In fact, as far as we know, nothing built into the operating system can identify the individual scripts running on a Windows 2000 computer; even Task Manager reports only the process names (Cscript.exe and Wscript.exe).

If you’re running Windows XP or Windows Server 2003, however, then we have a different – and better – answer for you. With Windows XP a new property – CommandLine – was added to the Win32_Process class. As the name implies, CommandLine tells you the actual command used to start a process. For example, suppose you started a script by typing cscript my_script.vbs at the command prompt. The CommandLine property for that script will be this:

cscript my_script.vbs

In other words, now you know that script named My_Script.vbs is running on this machine.

But what if you don’t use the command prompt to start a script, what if you double-click the file icon in Windows Explorer and run the script under Wscript? No problem. Say you double-click the file C:\Scripts\My_Script.vbs; you’ll get back a CommandLine value like this:

C:\WINDOWS\System32\WScript.exe “C:\Scripts\My_Script.vbs”

As you can see, we get the path to the Wscript executable file along with the path to the script that’s actually running. Now that’s more like it, huh?

At any rate, if you’re running Windows XP or Windows Server 2003, here’s a script that will do the trick for you:

strComputer = “.”
Set objWMIService = GetObject(“winmgmts:” _
    & “{impersonationLevel=impersonate}!\\” & strComputer & “\root\cimv2”)
Set colItems = objWMIService.ExecQuery _
    (“Select * from Win32_Process Where Name = ‘cscript.exe'” & _
        ” OR Name = ‘wscript.exe'”)
For Each objItem in colItems
    Wscript.Echo objItem.CommandLine
Next