Search code examples
windowsbatch-filewmic

Command Line output still remains as null using WMIC, but displays in taskmgr gui (Windows)

the below shows display in the GUI of frmweb.exe process ( attached image/png ) where command line arguments are visible.

when the same is tried to be captured via command line it throws null. steps below is pasted as text. Need help with this, thanks

wmic path win32_process get name, commandline /format:"%WINDI%\System32\wbem\csv" | find "frmweb.exe" >  commandline.txt

notepad commandline.txt

vbox_host,,frmweb.exe
vbox_host
vbox_host,,frmweb.exe
vbox_host
vbox_host,,frmweb.exe
vbox_host
vbox_host,,frmweb.exe
vbox_host
vbox_host,,frmweb.exe
vbox_host
vbox_host,,frmweb.exe
vbox_host
vbox_host,,frmweb.exe
vbox_host
vbox_host,,frmweb.exe
vbox_host
vbox_host,,frmweb.exe
vbox_host
vbox_host,find  "frmweb.exe" ,find.exe

Here is a screenshot: enter image description here

Solution

  • Just to ensure that you have actually tried to use a correct command, this is how I would probably perform the task using WMIC:

    WMIC Process Where "Name='frmweb.exe'" Get CommandLine,Name /Format:"C:\Windows\System32\wbem\en-US\csv.xsl">"CommandLines.csv"

    Because you've copied your csv.xsl file to C:\Windows\System32\wbem:

    WMIC Process Where "Name='frmweb.exe'" Get CommandLine,Name /Format:csv >commandline.txt

    If you're specifically wishing to exclude the header then:

    WMIC Process Where "Name='frmweb.exe'" Get CommandLine,Name /Format:csv|Find ".">commandline.txt

    I have a feeling that the comma in your CommandLine is causing the issue.

    It may help if you change the way the results are transformed into output, so here's a suggestion.

    Open the csv.xsl you've copied to %SystemRoot%\System32\wbem in a text editor and change the line:

    <xsl:template match="VALUE" xml:space="preserve"><xsl:value-of select="."/></xsl:template>

    To:

    <xsl:template match="VALUE" xml:space="preserve">"<xsl:value-of select="."/>"</xsl:template>

    The idea being that you're asking it to doublequote each value field of the csv output.

    To ensure that the output is not actually null, you could test the command from PowerShell instead:

    GWMI Win32_Process -F "Name='frmweb.exe'"|Select Name,CommandLine|Export-CSV -U -NoT .\commandline.txt