Win32_Thread class

Article
01/06/2021

The Win32_Thread WMI class represents a thread of execution. While a process must have one thread of execution, the process can create other threads to execute tasks in parallel. Threads share the process environment, thus multiple threads under the same process use less memory than the same number of processes.

The following syntax is simplified from Managed Object Format (MOF) code and includes all of the inherited properties. Properties and methods are in alphabetic order, not MOF order.

Syntax

[Dynamic, Provider("CIMWin32"), UUID("{8502C4DD-5FBB-11D2-AAC1-006008C78BC7}"), AMENDMENT]
class Win32_Thread : CIM_Thread
{
  string   Caption;
  string   CreationClassName;
  string   CSCreationClassName;
  string   CSName;
  string   Description;
  uint64   ElapsedTime;
  uint16   ExecutionState;
  string   Handle;
  datetime InstallDate;
  uint64   KernelModeTime;
  string   Name;
  string   OSCreationClassName;
  string   OSName;
  uint32   Priority;
  uint32   PriorityBase;
  string   ProcessCreationClassName;
  string   ProcessHandle;
  uint32   StartAddress;
  string   Status;
  uint32   ThreadState;
  uint32   ThreadWaitReason;
  uint64   UserModeTime;
};

Members

The Win32_Thread class has these types of members:

Properties

Properties

The Win32_Thread class has these properties.

Caption

Data type: string
Access type: Read-only
Qualifiers: MaxLen (64), DisplayName ("Caption")

Short description of the object.

This property is inherited from CIM_ManagedSystemElement.

CreationClassName

Data type: string
Access type: Read-only
Qualifiers: Cim_Key, MaxLen (256)

Name of the first concrete class to appear in the inheritance chain used in the creation of an instance. When used with the other key properties of the class, this property allows all instances of this class and its subclasses to be uniquely identified.

This property is inherited from CIM_Thread.

CSCreationClassName

Data type: string
Access type: Read-only
Qualifiers: Propagated ("CIM_Process.CSCreationClassName"), Cim_Key, MaxLen (256)

Creation class name of the scoping computer system.

This property is inherited from CIM_Thread.

CSName

Data type: string
Access type: Read-only
Qualifiers: Propagated ("CIM_Process.CSName"), Cim_Key, MaxLen (256)

Name of the scoping computer system.

This property is inherited from CIM_Thread.

Description

Data type: string
Access type: Read-only
Qualifiers: DisplayName ("Description")

Description of the object.

This property is inherited from CIM_ManagedSystemElement.

ElapsedTime

Data type: uint64
Access type: Read-only
Qualifiers: MappingStrings ("Win32API|Performance Data Structures|PERF_OBJECT_TYPE|PerfTime"), Units ("milliseconds")

Total execution time, in milliseconds, given to this thread since its creation.

For more information about using uint64 values in scripts, see Scripting in WMI.

ExecutionState

Data type: uint16
Access type: Read-only

Current operating condition of the thread.

This property is inherited from CIM_Thread.

Unknown (0)

Other (1)

Ready (2)

Running (3)

Blocked (4)

Suspended Blocked (5)

Suspended Ready (6)

Handle

Data type: string
Access type: Read-only
Qualifiers: MaxLen (256), Override ("Handle"), MappingStrings ("Win32API|Tool Help Structures|THREADENTRY32|th32ThreadID")

Handle to a thread. The handle has full access rights by default. With the correct security access, the handle can be used in any function that accepts a thread handle. Depending on the inheritance flag specified when it is created, this handle can be inherited by child processes.

InstallDate

Data type: datetime
Access type: Read-only
Qualifiers: MappingStrings ("MIF.DMTF|ComponentID|001.5"), DisplayName ("Install Date")

Object was installed. This property does not need a value to indicate that the object is installed.

This property is inherited from CIM_ManagedSystemElement.

KernelModeTime

Data type: uint64
Access type: Read-only
Qualifiers: Override ("KernelModeTime"), MappingStrings ("Win32API|Performance Data Structures|PERF_OBJECT_TYPE|PrivilegedTime"), Units ("100 nanoseconds")

Time in kernel mode, in 100 nanosecond units. If this information is not available, a value of 0 (zero) should be used.

For more information about using uint64 values in scripts, see Scripting in WMI.

Name

Data type: string
Access type: Read-only
Qualifiers: DisplayName ("Name")

Label by which the object is known. When subclassed, the property can be overridden to be a key property.

This property is inherited from CIM_ManagedSystemElement.

OSCreationClassName

Data type: string
Access type: Read-only
Qualifiers: Propagated ("CIM_Process.OSCreationClassName"), Cim_Key, MaxLen (256)

Creation class name of the scoping operating system.

This property is inherited from CIM_Thread.

OSName

Data type: string
Access type: Read-only
Qualifiers: Propagated ("CIM_Process.OSName"), Cim_Key, MaxLen (256)

Name of the scoping operating system.

This property is inherited from CIM_Thread.

Priority

Data type: uint32
Access type: Read-only
Qualifiers: Override ("Priority"), MappingStrings ("Win32API|Tool Help Structures|THREADENTRY32|tpDeltaPri")

Dynamic priority of the thread. Each thread has a dynamic priority that the scheduler uses to determine which thread to execute. Initially, a thread's dynamic priority is the same as its base priority. The system can raise and lower the dynamic priority, to ensure that it is responsive (guaranteeing that no threads are starved for processor time). The system does not boost the priority of threads with a base priority level between 16 and 31. Only threads with a base priority between 0 and 15 receive dynamic priority boosts. Higher numbers indicate higher priorities.

PriorityBase

Data type: uint32
Access type: Read-only
Qualifiers: MappingStrings ("Win32API|Performance Data Structures|PERF_OBJECT_TYPE|PerfPriorityBase")

Current base priority of a thread. The operating system may raise the thread's dynamic priority above the base priority if the thread is handling user input, or lower it toward the base priority if the thread becomes compute-bound. The PriorityBase property can have a value between 0 and 31.

ProcessCreationClassName

Data type: string
Access type: Read-only
Qualifiers: Propagated ("CIM_Process.CreationClassName"), Cim_Key, MaxLen (256)

Value of the scoping process CreationClassName property.

This property is inherited from CIM_Thread.

ProcessHandle

Data type: string
Access type: Read-only
Qualifiers: MaxLen (256), Override ("ProcessHandle"), Propagated ("CIM_Process.Handle"), MappingStrings ("Win32API|Tool Help Structures|THREADENTRY32|th32OwnerProcessID")

Process that created the thread. The contents of this property can be used by Windows application programming interface (API) elements.

StartAddress

Data type: uint32
Access type: Read-only
Qualifiers: MappingStrings ("WIn32API|Thread Object|LPTHREAD_START_ROUTINE|lpStartAddress")

Starting address of the thread. Because any application with appropriate access to the thread can change the thread's context, this value may only be an approximation of the thread's starting address.

Status

Data type: string
Access type: Read-only
Qualifiers: MaxLen (10), DisplayName ("Status")

Current status of the object. Various operational and nonoperational statuses can be defined. Operational statuses include: "OK", "Degraded", and "Pred Fail" (an element, such as a SMART-enabled hard disk drive, may be functioning properly but predicting a failure in the near future). Nonoperational statuses include: "Error", "Starting", "Stopping", and "Service". The latter, "Service", could apply during mirror-resilvering of a disk, reload of a user permissions list, or other administrative work. Not all such work is online, yet the managed element is neither "OK" nor in one of the other states.

This property is inherited from CIM_ManagedSystemElement.

The values are:

OK ("OK")

Error ("Error")

Degraded ("Degraded")

Unknown ("Unknown")

Pred Fail ("Pred Fail")

Starting ("Starting")

Stopping ("Stopping")

Service ("Service")

Stressed ("Stressed")

NonRecover ("NonRecover")

No Contact ("No Contact")

Lost Comm ("Lost Comm")

ThreadState

Data type: uint32
Access type: Read-only
Qualifiers: MappingStrings ("Win32API|Thread State")

Current execution state for the thread.

Initialized (0)

Initialized — It is recognized by the microkernel.

Ready (1)

Ready — It is prepared to run on the next available processor.

Running (2)

Running — It is executing.

Standby (3)

Standby — It is about to run, only one thread may be in this state at a time.

Terminated (4)

Terminated — It is finished executing.

Waiting (5)

Waiting — It is not ready for the processor, when ready, it will be rescheduled.

Transition (6)

Transition — The thread is waiting for resources other than the processor,

Unknown (7)

Unknown — The thread state is unknown.

ThreadWaitReason

Data type: uint32
Access type: Read-only
Qualifiers: MappingStrings ("Win32API|Thread Wait Reason")

Reason why the thread is waiting. This value is only valid if the ThreadState member is set to Transition (6). Event pairs allow communication with protected subsystems.

Executive (0)

FreePage (1)

FreePage

PageIn (2)

PoolAllocation (3)

ExecutionDelay (4)

FreePage (5)

PageIn (6)

Executive (7)

FreePage (8)

PageIn (9)

PoolAllocation (10)

ExecutionDelay (11)

FreePage (12)

PageIn (13)

EventPairHigh (14)

EventPairLow (15)

LPCReceive (16)

LPCReply (17)

VirtualMemory (18)

PageOut (19)

Unknown (20)

UserModeTime

Data type: uint64
Access type: Read-only
Qualifiers: Override ("UserModeTime"), MappingStrings ("Win32API|Performance Data Structures|PERF_OBJECT_TYPE|UserTime"), Units ("100 nanoseconds")

Time in user mode, in 100 nanoseconds units. If this information is not available, a value of 0 (zero) should be used.

For more information about using uint64 values in scripts, see Scripting in WMI.

Remarks

The Win32_Thread class is derived from CIM_Thread.

Overview

For routine day-to-day monitoring, there is usually little reason to have a detailed list of threads and their associated properties. Computers create and delete thousands of threads during the course of a day, and few of these creations or deletions are meaningful to anyone but the developer who wrote the software.

However, when you are troubleshooting problems with an application, tracking the individual threads for a process allows you to identify when threads are created and when (or if) they are destroyed. Because threads that are created but not destroyed cause memory leaks, tracking individual threads can be useful information for support technicians. Likewise, identifying thread priorities can help pinpoint threads that, by running at an abnormally high priority, are preempting CPU cycles needed by other threads and other processes.

Using Win32_Thread

As implied in the preceding syntax block, the Win32_Thread class does not report the name of the process under which each thread runs. Instead, it reports the ID of the process under which the thread runs. To return the name of a process and a list of all its threads, your script must:

Connect to the Win32_Process class and return the list of processes and their process IDs.
Temporarily store this information in an array or Dictionary object.
For each process ID, return the list of threads for that process, and then display the process name and the list of threads.

Examples

The following VBScript sample monitors the threads running on a computer.

Set objDictionary = CreateObject("Scripting.Dictionary")
strComputer = "."
Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colProcesses = objWMIService.ExecQuery("SELECT * FROM Win32_Process")
For Each objProcess in colProcesses
 objDictionary.Add objProcess.ProcessID, objProcess.Name
Next
Set colThreads = objWMIService.ExecQuery("SELECT * FROM Win32_Thread")
For Each objThread in colThreads
 intProcessID = CInt(objThread.ProcessHandle)
 strProcessName = objDictionary.Item(intProcessID)
 Wscript.Echo strProcessName & VbTab & objThread.ProcessHandle & _
              VbTab & objThread.Handle & VbTab & objThread.ThreadState
Next

Requirements

Requirement	Value
Minimum supported client	Windows Vista
Minimum supported server	Windows Server 2008
Namespace	Root\CIMV2
MOF	CIMWin32.mof
DLL	CIMWin32.dll

Win32_Thread class

Syntax

Members

Properties

Remarks

Examples

Requirements

See also

Feedback

Feedback

Additional resources