Get-Process

Get a list of processes running on a machine

Syntax
      Get-Process [[-name] string[]] [-ComputerName string[]]
         [-FileVersionInfo] [-Module] [CommonParameters]
    
      Get-Process -id Int32[] [-ComputerName string[]]
         [-FileVersionInfo] [-Module] [CommonParameters]
    
      Get-Process -inputObject Process[] [-ComputerName string[]]
         [-FileVersionInfo] [-Module] [CommonParameters]

Key
   -name 
       Process name(s)
       Separate multiple process names with commas or use wildcard characters. 
       The -Name is optional.
        
   -inputObject 
       Accept process object(s) as input to Get-Process.  
       A variable, command or expression that returns the process object(s)
        
   -id Int32
       Process ID(s) (PID). Use commas to separate multiple PIDs.
       To find the PID of a process, type "get-process".

   -ComputerName string[]
       Get the processes running on the specified computers.
       The default is the local computer.  

       Type the NetBIOS name, an IP address, or a fully qualified domain name
       of one or more computers. 
       To specify the local computer, type the computer name, a dot (.), or "localhost".

       This parameter does not rely on PowerShell remoting.

   -FileVersionInfo
       Get the file version information for the program that runs in the process. 

       On Windows Vista and later versions of Windows, you must open PowerShell with
       the "Run as administrator" option to use this parameter on processes that you do not own.

       Using this parameter is equivalent to getting the MainModule.FileVersionInfo property
       of each process object. When you use -FileVersionInfo, Get-Process returns a FileVersionInfo object
       (System.Diagnostics.FileVersionInfo), not a process object. So in this case, you cannot pipe 
       the output to a cmdlet that expects a process object, such as Stop-Process.

   -Module
       Get the modules that have been loaded by the processes.
       On Windows Vista and later versions of Windows, you must open PowerShell with
       the "Run as administrator" option to use this parameter on processes that you do not own.

       This parameter is equivalent to getting the Modules property of each process object.
       When you use this parameter, Get-Process returns a ProcessModule object
       (System.Diagnostics.ProcessModule), not a process object. So in this case, you cannot pipe
       the output of the command to a cmdlet that expects a process object, such as Stop-Process.

       If both -Module and -FileVersionInfo  are specified in the same command,
       Get-Process returns a FileVersionInfo object with information about the file version of all modules.

   CommonParameters:
       -Verbose, -Debug, -ErrorAction, -ErrorVariable, -WarningAction, -WarningVariable,
       -OutBuffer -OutVariable.

Standard Aliases for Get-Process: ps, gps

Examples

List all the processes running on the local PC:

PS C:> get-process

List all available data about Winword and Explorer processes on this computer:

PS C:> get-process winword, explorer | format-list *

List the available properties of process objects:

PS C:> Get-Process | Get-Member

Get the process of the current PowerShell session:

PS C:> Get-Process -id $pid

List the top 5 processes using the most CPU time:

PS C:> Get-Process | sort CPU | select -last 5

Get all processes that have a working set greater than 20 MB:

PS C:> get-process | where-object {$_.WorkingSet -gt 20000000}

List processes grouped by priority.:

PS C:> $a = get-process
PS C:> get-process -inputobject $a | format-table -view priority

List all processes beginning with "s", and see when each running program was last updated. (newly updated executables can be a sign of a malware infection) This is done by piping the pathname of each executable into DIR and sorting by the last write time:

PS C:> get-process s*|where {s$_.Path} | dir | sort LastWriteTime |
format-table fullname, name,@{label="LastWriteTime";Expr={$_.LastWriteTime}

Get all the processes from several machines and display the memory usage:

$procs = get-process -computername server64,server65 |sort "WorkingSet"
foreach($proc in $procs)
{
   $NonPagedMem = [int]($proc.NPM/1024)
   $WorkingSet = [int64]($proc.WorkingSet64/1024)
   $VirtualMem = [int]($proc.VM/1MB)
   $id= $proc.Id
   $machine = $proc.MachineName
   $process = $proc.ProcessName
   $procdata = new-object psobject
   $procdata | add-member noteproperty NonPagedMem $NonPagedMem
   $procdata | add-member noteproperty WorkingSet $WorkingSet 
   $procdata | add-member noteproperty machine $machine
   $procdata | add-member noteproperty process $process

$procdata | Select-Object machine,process,WorkingSet,NonPagedMem
}

Note that on 64 bit systems, some processes can have a very large working set that will overflow the Int32 value producing a negative number.

“Life is a process of becoming, a combination of states we have to go through. Where people fail is that they wish to elect a state and remain in it. This is a kind of death” ~ Anaïs Nin

Related:

Stop-Process - Stop a running process (kill)
Equivalent bash command: ps - Process status


© Copyright SS64.com 1999-2014
Some rights reserved