How Can I Tell Which Scripts are Running on a Computer?

Hey, Scripting Guy! Question

Hey, Scripting Guy! How can I tell which scripts are running on a computer?

-- NW

SpacerHey, Scripting Guy! AnswerScript Center

Hey, NW. This is a question we’re always a little reluctant to answer, because there’s a 50-50 chance you’ll be disappointed with what you hear. If you are running Windows 2000 (or a previous version of Windows), the answer is pretty straightforward: you can’t. A script such as this one - which looks for all processes running under Cscript.exe or Wscript.exe - can tell that scripts are running on a computer:

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colItems = objWMIService.ExecQuery _
("Select * from Win32_Process Where Name = 'cscript.exe'" & _
" OR Name = 'wscript.exe'")
For Each objItem in colItems
Wscript.Echo objItem.Name

However, this script can’t tell you the names of those scripts. In fact, as far as we know, nothing built into the operating system can identify the individual scripts running on a Windows 2000 computer; even Task Manager reports only the process names (Cscript.exe and Wscript.exe).

If you’re running Windows XP or Windows Server 2003, however, then we have a different - and better - answer for you. With Windows XP a new property - CommandLine - was added to the Win32_Process class. As the name implies, CommandLine tells you the actual command used to start a process. For example, suppose you started a script by typing cscript my_script.vbs at the command prompt. The CommandLine property for that script will be this:

cscript my_script.vbs

In other words, now you know that script named My_Script.vbs is running on this machine.

But what if you don’t use the command prompt to start a script, what if you double-click the file icon in Windows Explorer and run the script under Wscript? No problem. Say you double-click the file C:\Scripts\My_Script.vbs; you’ll get back a CommandLine value like this:

C:\WINDOWS\System32\WScript.exe "C:\Scripts\My_Script.vbs"

As you can see, we get the path to the Wscript executable file along with the path to the script that’s actually running. Now that’s more like it, huh?

At any rate, if you’re running Windows XP or Windows Server 2003, here’s a script that will do the trick for you:

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colItems = objWMIService.ExecQuery _
("Select * from Win32_Process Where Name = 'cscript.exe'" & _
" OR Name = 'wscript.exe'")
For Each objItem in colItems
Wscript.Echo objItem.CommandLine

Comments (8)

  1. mredwilson says:

    @Romi there is a registry setting that controls the ability to run VBScript. However, if you were to disable it, lots of things might very well break. If you script is slowing down, the first thing I would do is check it for malware and virus problems. Visit the Microsoft Security site for a free online scan tool. If you machine is clean, then the next thing to do would be to defrag the hard disk. If you still have problems, look at msconfig (native) or autoruns (sysinternals) tools and see what things are automatically starting. Now days, it seems everytime I turn around another program is launching automatically and eating up system resources. Beyond that, you should seek assistance from your provider or network admin because I am not a desktop support person and there are LOTS of things I do not know about troubleshooting pc's.

  2. romi says:

    I got a feeling that my machine is slowing down significantly because it is running scripts.  Is it possible to shut this down,  and if so, will that affect anything on my machine?

  3. sandi says:

    i am so grateful that talented compuer geeks like yourself share your wisdom free with peple like me.  THANKSQ

  4. Ed Wilson says:

    @Sandi you are welcome. I am glad that I am able to help.

  5. Dartyr says:

    I'm trying to catch all scripts in one window, box or popup instead of apart popups.

    I also want a script to check if a specific script is running,

    how can I get the name of the script in a check?

  6. maggie says:

    I keep getting a response  runnng scripts.    There should be no activity at the time.  How do I se the scripts, ofcancel them if I can't seee them?

    /thanks.    Maggie

  7. Harmon20 says:

    Awesome. Thanks for that. I had a system service monitoring a VPN tunnel with a ping on Win2k8Serv, sending me SMS when it was down. Tunnel went down intentionally & killing the task didn't kill the script. I couldn't kill all wscript.exe because I had some file copy scripts running. This helped me track down the TXTing script so I could kill it without interrupting the file copies.

  8. Andre says:

    My brother composed a script that shuts down my computer at 2 AM until 6 AM, while that’s ok, it happens randomly each time I start my computer after 6 AM (it is 9:50 AM and it’s still shutting me down). Is there any way I could find where it is located
    and remove it?

Skip to main content