When the WTSEnumerateProcesses method periodically obtains the process list, the new process is not obtained.

Question

When the WTSEnumerateProcesses method is used to obtain the process list by using the 1s to 3s timer, the new process is not obtained for a long time. After the client is restarted, the process is restored. What is the best solution?

Answer 1

You can try switching to WMI (Windows Management Instrumentation) for real-time process tracking instead of using WTSEnumerateProcesses with a timer. With WMI, you subscribe to events like when a process starts or stops, so you get instant updates without constantly polling. It’s way more efficient and avoids the issue of missing quick-starting processes.

Here is an example:

using System; 

using System.Management; 

class ProcessWatcher 

{ 

    public static void Main() 

    { 

        // Watch for process creation events 

        ManagementEventWatcher processStartWatcher = new ManagementEventWatcher( 

            new WqlEventQuery("SELECT * FROM Win32_ProcessStartTrace")); 

        // Subscribe to the event 

        processStartWatcher.EventArrived += new EventArrivedEventHandler(ProcessStarted); 

        processStartWatcher.Start(); 

        Console.WriteLine("Watching for process start events..."); 

        Console.ReadLine();  // Keep the program running 

    } 

    private static void ProcessStarted(object sender, EventArrivedEventArgs e) 

    { 

        Console.WriteLine("Process started: " + e.NewEvent.Properties["ProcessName"].Value); 

    } 

} 

This will automatically trigger when a new process starts, making it more responsive and reliable compared to polling every few seconds with WTSEnumerateProcesses.

Answer 2

Thank you for your reply.When the 3s timer is used for scheduling, the probability can be reduced. Is there a better method to replace this method?

Answer 3

Thank you for sharing the code, can you try increasing this interval to reduce the frequency of calls to WTSEnumerateProcesses. Let's say, 3 seconds? See if this works.

Answer 4

First thank you for your reply.

this code like :

WTSEnumerateProcesses(IntPtr.Zero, 0, 1, ref pProcessInfo, ref processCount);
I use this method to get process information, 
but I find that when called within the timer, 
I occasionally fail to get the latest process information.And it's not a necessary question.

Answer 5

Hello, thank you for reaching out to the Microsoft Community. I'm here to help with your questions or issues. Just note – this is a place where passionate Microsoft users help each other, we don't work directly for Microsoft.

Are there any patterns in the timing of process creation and termination that might be causing the issue? Are new processes being created and terminated very quickly?

Please share a snippet of the code you are using.