I have had this long standing issue with finding out if another process is still running. It seems simple, but there are special conditions that cause things to work improperly. I have set up a tester to help me deal with this and something interesting happened.

Let me first explain the setup I am using to test.

Client.exe - This is the program I want to watch. There may be multiple instances of this at once, so I watch is PID. I need to know if a particular instance goes away.

Server.exe - This gets a hello message from Client.exe which contains its PID. From this point, every one second it validates the clients by seeing if a process with the PIDs it knows about are missing. If they are missing, it remove the client from the list.

Tester.exe - Tester launches and kills the Client.exe at set intervals, like every 10 seconds.

TaskManager - Running to watch the process table.

Scenario 1:

Server.exe is using CreateToolSnapshot to look up the PID.

A. When Tester.exe kills Client.exe, then the CreateToolSnapshot() suddenly starts to fail for Server.exe with error 8, that is "Out of Memory". Client.exe disappears from Task Manager.

B. If after A happens, I then exit Tester.exe, suddenly things clear up for Service.exe and it can now see that Client.exe with PID XXXX is gone.

C. When TaskManager kills Client.exe, Server.exe can detect the process disappearing without issue.

Scenario 2:

Service.exe is using OpenProcess(SYNCHRONIZE , false, PID) to see if PID is running. I am using SYNCHRONIZE because it is the least privileged access AFAIK.

A. When Tester.exe kills Client.exe, the OpenProcess SUCCEEDS long after Client.exe stops running. Again task manager accurately shows that Client.exe is no longer running.

B. After A happens, once again quitting Tester.exe will suddenly allow Server.exe to resolve all the PIDs it had correctly and will now report all the PIDs it had from the various toggles Tester.exe is no longer running.

C. If task manager kills Client.exe, Service.exe correctly can tell that the PID is no longer there.

I know that Tester.exe is probably bugged in some way (maybe it isn't closing a handle). In a way this is a good thing because it is giving me an unusual 'bug' that I would otherwise not be able to see.

The real problem is, how can service.exe correctly find out of PID is running? Both the toolsnapshot and OpenProcess() do not work right under these circumstances.