Hi,
I have to monitor if a process is running under a specific user in Windows.

I use Process.CountEx for doing that.

In Taskmanager the username is shown like AD001\z004abcd
Processname is EB_BPM.exe

I tried: Process.CountEx("EB_BPM.exe",,"AD001\z004abcd")
and ( in case the Backslash is the problem):  Process.CountEx("EB_BPM.exe",,"(?i)z004abcd")

Both fail.
Using just  Process.CountEx("EB_BPM.exe") works, but I need to have the username.


Using  NetXMS 5.2.1
Any idea?

Stefan

Did you try
Process.CountEx("EB_BPM.exe",,"z004abcd")
?

I tried. It's also not working. Always returning 0.

In logfile with Loglevel 7 I find:

2025.06.23 09:08:32.521 *D* [comm.cs.1          ] Requesting metric "Process.CountEx("EB_BPM.exe",,"z004abcd")"
2025.06.23 09:08:32.555 *D* [comm.cs.1          ] GetMetricValue("Process.CountEx("EB_BPM.exe",,"z004abcd")"): 0 (SUCCESS) value = "0"

But the process is running.

Do You need more information to solve this? Please let me know.

Regards

Stefan

how do you see this process in "Processes" view for that node?

In process view the column user is almost empty.


Only BUILTIN\Administrators shows up for some processes.

Well, that explains why the metric does not return what you expect. 

How do you run the agent - under SYSTEM user or in some other way?

We have the agent running with a domain account, that is member of the Administrators group.

Please try to run the agent under system user to see if that makes any difference

Running it as system now shows the usernames in the Process View. But why doesn't it work with an administrative account?

Agent uses GetSecurityInfo win api function, please check information about needed access rights here:
https://learn.microsoft.com/en-us/windows/win32/api/aclapi/nf-aclapi-getsecurityinfo#remarks