use Win32::OLE; my $objWMIService; unless ($objWMIService = Win32::OLE->GetObject("winmgmts:{impersonationLevel=impersonate}!\\\\.\\root\\cimv2")) { print("Could not connect to WMI Service on localhost while attempting to collect a remote item. The error returned was: " . Win32::OLE->LastError() . "."); } my $colItems; unless($colItems= $objWMIService->ExecQuery("SELECT * FROM Win32_Process", "WQL",0x10 | 0x20)) #unless($colItems= $objWMIService->ExecQuery("SELECT * FROM Win32_Process")) { print("Could not extract notification query from WMI Service on localhost . The error returned was: " . Win32::OLE->LastError() . "."); } foreach my $objItem (in $colItems) { if(defined($objItem->{CommandLine}) && ($objItem->{CommandLine} =~ /^.*[Ss][Mm][Ss][Ss]\.[Ee][Xx][Ee]$/)) { print "#################################################\n"; print "CommandLine: '" . $objItem->{CommandLine} . "'.\n"; print "ExecutablePath: '" . $objItem->{ExecutablePath} . "'.\n"; print "Name: '" . $objItem->{Name} . "'.\n"; print "Caption: '" . $objItem->{Caption} . "'.\n"; print "#################################################\n"; } }