Re: 16-bit process

From: [MS] Scott McNairy (scotmc_at_online.microsoft.com)
Date: 03/24/04 

Date: Wed, 24 Mar 2004 10:25:14 -0800

NTVDM.exe is the controlling process and the 16 bit application can be
terminated (not sure if that is what you want to do) by terminating the
NTVDM.exe process. If you are looking for the threads this query will
help - 16 bit apps like DrWatson are single threaded, + the controlling
process NTVDM.exe and WowExec.exe, not sure what that one does, it also
plays a role in running a 16 bit application. Once you have your
processHandle, you can issue this query to get the relevant threads.

select * from win32_process where caption = "ntvdm.exe"
then...
select * from win32_thread where processHandle = "676"

NTVDM.exe is an application that provides the environment for a 16-bit
process to execute on a 32-bit platform like Windows XP. 

-- 
[MS] Scott McNairy
WMI Test Engineer
This posting is provided "As Is" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm
"AOUser" <rjgeers@hotmail.com> wrote in message
news:1ddab067.0403240703.3308192d@posting.google.com...
> We monitor our w2k servers with Tivoli Monitoring. This product uses
> WMI/CIM for getting the data. I created a model to intercept unwanted
> 32-bit processes. But with WMI I cant get the 16-bit processes( f.i.
> drwatson.exe).
> THe 16-bit processes are gathered with ntvdm.exe (this has its own
> process id), but they dont have their own process id's. HELP. Where do I
find
> those process/threads in WMI/CIM?
> Thx in advance.