如何确保当用户 A 尝试打开 .doc(x) 文件时,它将在 Word Viewer 中打开,而当用户 B 执行相同操作时,它将在 Word 2013 中打开。该软件已安装在系统上,我只是想知道如何区分这两者。两个用户都在 RDS 上远程工作。
答案1
方式1、WSH vbscript、WMI 查询:
获取进程信息.vbs:
strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colProcessList = objWMIService.ExecQuery("SELECT * FROM Win32_Process WHERE (Name = ""winword.exe"" OR Name = ""WORDVIEW.EXE"") ")
Dim strInfo
Wscript.Echo "Caption ProcessId ParentProcessId SessionId ThreadCount UserName CommandLine"
For Each objProcess in colProcessList
strInfo = objProcess.Caption
strInfo = strInfo & " " & objProcess.ProcessId
strInfo = strInfo & " " & objProcess.ParentProcessId
strInfo = strInfo & " " & objProcess.SessionId
strInfo = strInfo & " " & objProcess.ThreadCount
objProcess.GetOwner strNameOfUser, strUserDomain
strInfo = strInfo & " " & strUserDomain & "\" & strNameOfUser
strInfo = strInfo & " " & objProcess.CommandLine
Wscript.Echo strInfo
Next
输出:
Caption ProcessId ParentProcessId SessionId ThreadCount UserName CommandLine
WINWORD.EXE 10032 10480 0 7 HT\Administrator "C:\App32\Microsoft Office\Office12\WINWORD.EXE"
WORDVIEW.EXE 17120 17800 0 4 HT\Administrator "C:\App32\Microsoft Office\OFFICE11\WORDVIEW.EXE"
获取SessionId命令行:
query user
输出:
USERNAME SESSIONNAME ID STATE IDLE TIME LOGON TIME
>administrator console 0 Active . 13.08.2013 18:52
方式2,tasklist,命令行:
tasklist /FI "IMAGENAME eq WINWORD.EXE" /V /FO CSV | find /V /I "INFO:"
tasklist /FI "IMAGENAME eq WORDVIEW.EXE" /V /FO CSV | find /V /I "INFO:"
方式 3、任务管理器 GUI:
方式四、命令行,powershell:
powershell ps^|?{$_.Name -eq'WINWORD' -or $_.Name -eq'WORDVIEW'}^|FT MainWindowTitle,Path,Id,Name,SessionId -Au;query user
方式五、powershell脚本:
获取进程信息.ps1:
$own=@{};gwmi win32_process|%{$own[$_.handle]=$_.getowner().user}
ps|?{$_.Name -eq 'WINWORD' -or $_.Name -eq 'WORDVIEW'}|FT MainWindowTitle,Path,SessionId,Name,Id,@{n="Owner";e={$own[$_.Id.ToString()]}} -Au