
PowerShell: Process Wrangling with Get-Process
In it’s simplest form the PowerShell command Get-Process will return all running processes. In this article, we will explore all the powerful ways to use the Get-Process command.
The Basics
Get-Process
- List all running processes123456789101112131415161718PS C:\dev\playground> Get-ProcessHandles NPM(K) PM(K) WS(K) CPU(s) Id SI ProcessName------- ------ ----- ----- ------ -- -- -----------479 45 72088 95316 5.05 16984 9 Adobe CEF Helper901 56 84624 122208 38.19 11072 9 Adobe Desktop Service244 18 5232 11524 7.73 9776 9 AdobeIPCBroker267 17 3732 10908 0.66 3452 0 AdobeUpdateService115 9 1828 2264 0.08 13584 0 svchost134 9 1844 7640 0.06 14116 0 svchost235 16 2856 10928 3.23 15936 0 svchost4848 0 184 18136 3,883.41 4 0 System483 37 9264 23040 1.78 10000 9 taskhostw115 7 1696 7088 0.05 1536 9 unsecapp668 22 10268 21888 21.17 5968 0 WmiPrvSE378 17 26128 10260 2.16 1348 0 WUDFHost328 19 6272 14144 5.94 4052 0 ZeroConfigService### output truncated
Get-Process explorer
- Get process(es) by name.
Note: This command may return more than one result if multple instances of an application are running. Get-Process a*
- Wildcard Query search for processes by name12345678910111213PS C:\dev\playground> Get-Process a*Handles NPM(K) PM(K) WS(K) CPU(s) Id SI ProcessName------- ------ ----- ----- ------ -- -- -----------479 45 72208 95800 6.20 16984 9 Adobe CEF Helper912 56 84628 122356 54.34 11072 9 Adobe Desktop Service244 18 5584 11776 13.14 9776 9 AdobeIPCBroker267 17 3732 10908 0.72 3452 0 AdobeUpdateService205 13 4732 11212 24.34 3520 0 AGSService219 20 3888 13388 6.70 16040 0 AppleMobileDeviceService632 38 13168 37336 1.89 9912 9 ApplePhotoStreams364 25 4984 17416 0.42 9764 9 APSDaemon516 23 30828 35288 3,189.81 14576 0 audiodg
Get-Process -Id 3916
- Get process by id or PID
Get-Process -iD 3916 | Select-Object *
- Get all available information about a single process.1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071PS C:\dev\playground> Get-Process -iD 3916 | Select-Object *Name : WavesSysSvc64Id : 3916PriorityClass : NormalFileVersion : 1.1.6.0HandleCount : 97WorkingSet : 3276800PagedMemorySize : 2433024PrivateMemorySize : 2433024VirtualMemorySize : 36986880TotalProcessorTime : 00:00:00.0312500SI : 0Handles : 97VM : 36986880WS : 3276800PM : 2433024NPM : 8624Path : C:\Program Files\Waves\MaxxAudio\WavesSysSvc64.exeCompany : Waves Audio Ltd.CPU : 0.03125ProductVersion : 1.1.6.0Description : WavesSysSvc Service ApplicationProduct : Waves MaxxAudio__NounName : ProcessBasePriority : 8ExitCode :HasExited : FalseExitTime :Handle : 1896SafeHandle : Microsoft.Win32.SafeHandles.SafeProcessHandleMachineName : .MainWindowHandle : 0MainWindowTitle :MainModule : System.Diagnostics.ProcessModule (WavesSysSvc64.exe)MaxWorkingSet : 1413120MinWorkingSet : 204800Modules : {System.Diagnostics.ProcessModule (WavesSysSvc64.exe), System.Diagnostics.ProcessModule (ntdll.dll),System.Diagnostics.ProcessModule (KERNEL32.DLL), System.Diagnostics.ProcessModule (KERNELBASE.dll)...}NonpagedSystemMemorySize : 8624NonpagedSystemMemorySize64 : 8624PagedMemorySize64 : 2433024PagedSystemMemorySize : 62752PagedSystemMemorySize64 : 62752PeakPagedMemorySize : 5505024PeakPagedMemorySize64 : 5505024PeakWorkingSet : 8888320PeakWorkingSet64 : 8888320PeakVirtualMemorySize : 40390656PeakVirtualMemorySize64 : 40390656PriorityBoostEnabled : TruePrivateMemorySize64 : 2433024PrivilegedProcessorTime : 00:00:00.0312500ProcessName : WavesSysSvc64ProcessorAffinity : 255Responding : TrueSessionId : 0StartInfo : System.Diagnostics.ProcessStartInfoStartTime : 9/30/2017 4:33:01 PMSynchronizingObject :Threads : {3920, 5108}UserProcessorTime : 00:00:00VirtualMemorySize64 : 36986880EnableRaisingEvents : FalseStandardInput :StandardOutput :StandardError :WorkingSet64 : 3276800Site :Container :
Get-Process explorer -IncludeUsername
- Information about the process owner is not included in the output by default but can be by supplying the -IncludeUserName argument.12345PS C:\dev\playground> Get-Process explorer -IncludeUsername | Select-Object Id,Name,UserNameId Name UserName-- ---- --------7628 explorer MYCOMPUTER\me
Get-Process -FileVersionInfo explorer | Select-Object *
- Use the -FileVersionInfo argument to get detailed information about a executable file for a given process.
Note: Omitting| Select-Object *
only returns ProductVersion,FileVersion,FileName.12345678910111213141516171819202122232425262728293031PS C:\dev\playground> Get-Process -FileVersionInfo explorer | Select-Object *FileVersionRaw : 10.0.15063.608ProductVersionRaw : 10.0.15063.608Comments :CompanyName : Microsoft CorporationFileBuildPart : 15063FileDescription : Windows ExplorerFileMajorPart : 10FileMinorPart : 0FileName : C:\WINDOWS\Explorer.EXEFilePrivatePart : 608FileVersion : 10.0.15063.0 (WinBuild.160101.0800)InternalName : explorerIsDebug : FalseIsPatched : FalseIsPrivateBuild : FalseIsPreRelease : FalseIsSpecialBuild : FalseLanguage : English (United States)LegalCopyright : © Microsoft Corporation. All rights reserved.LegalTrademarks :OriginalFilename : EXPLORER.EXE.MUIPrivateBuild :ProductBuildPart : 15063ProductMajorPart : 10ProductMinorPart : 0ProductName : Microsoft® Windows® Operating SystemProductPrivatePart : 608ProductVersion : 10.0.15063.0SpecialBuild :
Working with multiple instances of an application
Get-Process notepad | Sort-Object StartTime | Select-Object Id,Name,StartTime
- List all instances of an application sorted by StartTime.123456789PS C:\dev\playground> Get-Process notepad | Sort-Object StartTime | Select-Object Id,Name,StartTimeId Name StartTime-- ---- ---------12524 notepad 10/7/2017 1:35:24 PM7708 notepad 10/7/2017 1:35:31 PM5380 notepad 10/7/2017 1:35:37 PM17424 notepad 10/7/2017 1:35:46 PM11336 notepad 10/7/2017 1:35:53 PM
Get-Process notepad | Sort-Object StartTime | Select-Object Id,Name,StartTime | Select -First 1
- Get the longest running instances of an application.12345PS C:\dev\playground> Get-Process notepad | Sort-Object StartTime | Select-Object Id,Name,StartTime | Select -First 1Id Name StartTime-- ---- ---------12524 notepad 10/7/2017 1:35:24 PM
Get-Process notepad | Sort-Object StartTime -Descending | Select-Object Id,Name,StartTime | Select -First 1
- Get the most recent running instances of an application.12345PS C:\dev\playground> Get-Process notepad | Sort-Object StartTime -Descending | Select-Object Id,Name,StartTime | Select -First 1Id Name StartTime-- ---- ---------11336 notepad 10/7/2017 1:35:53 PM
User Processes
Get Processes by Username
- 12345# Get Logged In User$myuser = $(Get-WMIObject -class Win32_ComputerSystem | select username).username# Query for User ProcessesGet-Process -IncludeUserName | Where-Object {$_.UserName -eq $myuser}
Process CPU and Memory Utilization
Get-Process | Sort-Object CPU -desc | Select-Object -first 5 | Format-Table Id,ProcessName,CPU
- Get top 5 processes by CPU utilization1234567891011PS C:\dev\playground> Get-Process | Sort-Object CPU -desc | Select-Object -first 5 | Format-Table Id,ProcessName,CPUId ProcessName CPU-- ----------- ---4 System 4038.0937514576 audiodg 3016.06253608 KillerService 2674.93755632 WmiPrvSE 2331.89062512156 chrome 1474.921875633.328125 KillerService2303.109375 WmiPrvSE1373.234375 chrome
gwmi Win32_PerfFormattedData_PerfProc_Process| sort PercentProcessorTime -desc | select IDProcess,Name,PercentProcessorTime | Select -First 7 | ft -auto
- This alternative command does not use Get-Process but does show top 5 processes with percentage of CPU utilization.1234567891011PS C:\dev\playground> gwmi Win32_PerfFormattedData_PerfProc_Process| sort PercentProcessorTime -desc | select IDProcess,Name,PercentProcessorTime | Select -First 7 | ft -autoIDProcess Name PercentProcessorTime--------- ---- --------------------0 _Total 1000 Idle 10012156 chrome#20 1717760 chrome#23 119880 chrome#24 1114576 audiodg 111168 chrome#21 5
get-process | Where-Object {$_.Responding -ne "True"}
- List all process that are hung or not responding.123456PS C:\dev\playground> get-process | Where-Object {$_.Responding -ne "True"}Handles NPM(K) PM(K) WS(K) CPU(s) Id SI ProcessName------- ------ ----- ----- ------ -- -- -----------1233 44 37768 92448 6.86 10804 9 ShellExperienceHost667 35 15172 44736 0.88 6688 9 SystemSettings
Get-Process | Where-Object {$_.WorkingSet -gt 100000000}
- Get all processes using more than 100MB of memory12345678910111213141516171819PS C:\dev\playground> Get-Process | Where-Object {$_.WorkingSet -gt 100000000}Handles NPM(K) PM(K) WS(K) CPU(s) Id SI ProcessName------- ------ ----- ----- ------ -- -- -----------909 56 84628 122312 48.98 11072 9 Adobe Desktop Service448 65 234176 256376 244.64 1168 9 chrome3253 123 289692 375732 970.67 3060 9 chrome420 54 156236 187296 194.78 5056 9 chrome279 55 174848 176724 48.19 5624 9 chrome460 56 164316 182924 104.59 6224 9 chrome319 36 95716 99716 26.48 8692 9 chrome563 41 252896 251396 445.02 12104 9 chrome444 56 193576 222024 1,357.28 12156 9 chrome438 55 154580 177040 19.86 17760 9 chrome2223 73 45192 113804 48.63 7628 9 explorer834 85 232872 188256 1,123.73 3952 0 MsMpEng1401 97 151420 198412 138.58 9768 9 PaintDotNet1328 88 234760 279732 293.44 11016 9 powershell_ise994 62 45524 98704 0.86 18308 9 SearchUI
Executing & Terminating Processes
Start-Process
- Let’s first learn how to launch a process from PowerShell. If we want to do anything interesting with our executing process we need use the -passthru argument so that the process id is pass back to our script.12345678# Execute notepad and print the process id (PID)$app = Start-Process notepad -passthruecho $app.Id# Launch 5 instances of notepad and keep track of the PIDs$procs = @{}1..5 | % { Start-Process notepad -passthru | ForEach-Object { $procs[$_.Id] = $_ }}echo $procs
Stop-Process
- Next, lets review how Stop-Process works1234567891011#Kill process by idStop-Process 19320#Kill process by nameStop-Process -processname notepad#Kill process using wildcard searchStop-Process -processname note*#Force termnation a process that is not respondingStop-Process -processname notepad -Force
Combining
Get-Process
andStop-Process
- 123456# Passing a Get-Process returned object to Stop-Process$p = Get-Process notepadStop-Process $p# Same as above but combined into one lineGet-Process notepad | Stop-Process
- Terminate the most recent instance of an application
- 12345678Get-Process notepad | Sort-Object StartTime -Descending | Select-Object Id,Name,StartTime | Select -First 1 | Stop-Process#Same command expanded for readabilityGet-Process notepad `| Sort-Object StartTime -Descending `| Select-Object Id,Name,StartTime `| Select -First 1 `| Stop-Process
- Terminate the oldest instance of an application
- 12345678Get-Process notepad | Sort-Object StartTime | Select-Object Id,Name,StartTime | Select -First 1 | Stop-Process#Same command expanded for readabilityGet-Process notepad `| Sort-Object StartTime `| Select-Object Id,Name,StartTime `| Select -First 1 `| Stop-Process
Terminate application instances in order, oldest to newest
- In this example we also introduce a 2 second delay between each call to Stop-Process.1234567891011121314151617181920212223# Terminal all instances of an application oldest to newest# Introducing a delay of 2 seconds between each terminationForeach( $p in Get-Process notepad | Sort-Object StartTime ){echo "Terminating $($p.Id)"Stop-Process $pecho "2 Second Delay"Start-Sleep -s 2}# Script OutputTerminating 48242 Second DelayTerminating 84162 Second DelayTerminating 164602 Second DelayTerminating 103002 Second DelayTerminating 100402 Second Delay#
- Start and Stop an Application
- 12345# Launch Notepad, wait 5 seconds and close it$app = Start-Process notepad -passthruecho $app.IdStart-Sleep -s 5Stop-Process $app.Id
- Start a process and wait for it to terminate
- 12345# Launch notepad and pause script until user closes it$app = Start-Process notepad -passthruecho "Notepad Launched"Wait-Process $app.Idecho "Notepad Closed"
Launch an application and count how long it was running for
- 123456789101112131415$StartTime = Get-Date# Launch Notepad$app = Start-Process notepad -passthruecho "Notepad Launched"# Wait for user to close applicationWait-Process $app.Idecho "Notepad Closed"$EndTime = Get-Dateecho "Notepad was running for $(($EndTime - $StartTime).Seconds) seconds"# Script OutputNotepad LaunchedNotepad ClosedNotepad was running for 17 seconds#
Executing & Terminating Multiple Processes
- 123456789#Start 10 instances of notepad, wait 5 seconds, and then terminate each instance$procs = New-Object System.Collections.ArrayList1..10 | % { Start-Process notepad -passthru | ForEach-Object { $procs.Add($_) | Out-Null }}Start-Sleep -s 5Foreach($p in $procs){echo $p.IdStop-Process $p}
I hope you have enjoyed this deep dive into the Get-Process command. If you have any suggestions or additions to this article please leave a comment down below.
Get-Process Properties Reference
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 | PS C:\> Get-Process | Get-Member -MemberType Properties TypeName: System.Diagnostics.Process Name MemberType Definition ---- ---------- ---------- Handles AliasProperty Handles = Handlecount Name AliasProperty Name = ProcessName NPM AliasProperty NPM = NonpagedSystemMemorySize64 PM AliasProperty PM = PagedMemorySize64 SI AliasProperty SI = SessionId VM AliasProperty VM = VirtualMemorySize64 WS AliasProperty WS = WorkingSet64 __NounName NoteProperty string __NounName=Process BasePriority Property int BasePriority {get;} Container Property System.ComponentModel.IContainer Container {get;} EnableRaisingEvents Property bool EnableRaisingEvents {get;set;} ExitCode Property int ExitCode {get;} ExitTime Property datetime ExitTime {get;} Handle Property System.IntPtr Handle {get;} HandleCount Property int HandleCount {get;} HasExited Property bool HasExited {get;} Id Property int Id {get;} MachineName Property string MachineName {get;} MainModule Property System.Diagnostics.ProcessModule MainModule {get;} MainWindowHandle Property System.IntPtr MainWindowHandle {get;} MainWindowTitle Property string MainWindowTitle {get;} MaxWorkingSet Property System.IntPtr MaxWorkingSet {get;set;} MinWorkingSet Property System.IntPtr MinWorkingSet {get;set;} Modules Property System.Diagnostics.ProcessModuleCollection Modules {get;} NonpagedSystemMemorySize Property int NonpagedSystemMemorySize {get;} NonpagedSystemMemorySize64 Property long NonpagedSystemMemorySize64 {get;} PagedMemorySize Property int PagedMemorySize {get;} PagedMemorySize64 Property long PagedMemorySize64 {get;} PagedSystemMemorySize Property int PagedSystemMemorySize {get;} PagedSystemMemorySize64 Property long PagedSystemMemorySize64 {get;} PeakPagedMemorySize Property int PeakPagedMemorySize {get;} PeakPagedMemorySize64 Property long PeakPagedMemorySize64 {get;} PeakVirtualMemorySize Property int PeakVirtualMemorySize {get;} PeakVirtualMemorySize64 Property long PeakVirtualMemorySize64 {get;} PeakWorkingSet Property int PeakWorkingSet {get;} PeakWorkingSet64 Property long PeakWorkingSet64 {get;} PriorityBoostEnabled Property bool PriorityBoostEnabled {get;set;} PriorityClass Property System.Diagnostics.ProcessPriorityClass PriorityClass {get;set;} PrivateMemorySize Property int PrivateMemorySize {get;} PrivateMemorySize64 Property long PrivateMemorySize64 {get;} PrivilegedProcessorTime Property timespan PrivilegedProcessorTime {get;} ProcessName Property string ProcessName {get;} ProcessorAffinity Property System.IntPtr ProcessorAffinity {get;set;} Responding Property bool Responding {get;} SafeHandle Property Microsoft.Win32.SafeHandles.SafeProcessHandle SafeHandle {get;} SessionId Property int SessionId {get;} Site Property System.ComponentModel.ISite Site {get;set;} StandardError Property System.IO.StreamReader StandardError {get;} StandardInput Property System.IO.StreamWriter StandardInput {get;} StandardOutput Property System.IO.StreamReader StandardOutput {get;} StartInfo Property System.Diagnostics.ProcessStartInfo StartInfo {get;set;} StartTime Property datetime StartTime {get;} SynchronizingObject Property System.ComponentModel.ISynchronizeInvoke SynchronizingObject {get;set;} Threads Property System.Diagnostics.ProcessThreadCollection Threads {get;} TotalProcessorTime Property timespan TotalProcessorTime {get;} UserProcessorTime Property timespan UserProcessorTime {get;} VirtualMemorySize Property int VirtualMemorySize {get;} VirtualMemorySize64 Property long VirtualMemorySize64 {get;} WorkingSet Property int WorkingSet {get;} WorkingSet64 Property long WorkingSet64 {get;} Company ScriptProperty System.Object Company {get=$this.Mainmodule.FileVersionInfo.CompanyName;} CPU ScriptProperty System.Object CPU {get=$this.TotalProcessorTime.TotalSeconds;} Description ScriptProperty System.Object Description {get=$this.Mainmodule.FileVersionInfo.FileDescription;} FileVersion ScriptProperty System.Object FileVersion {get=$this.Mainmodule.FileVersionInfo.FileVersion;} Path ScriptProperty System.Object Path {get=$this.Mainmodule.FileName;} Product ScriptProperty System.Object Product {get=$this.Mainmodule.FileVersionInfo.ProductName;} ProductVersion ScriptProperty System.Object ProductVersion {get=$this.Mainmodule.FileVersionInfo.ProductVersion;} |