Using the Get-Process Cmdlet

Retrieving Process Information

The Get-Process cmdlet provides a quick and easy way to retrieve information about the processes running on your computer. To get a quick overview of all the processes currently running on your machine simply call Get-Process without any parameters:

Get-Process

By default, you’ll get back data similar to this:

Believe it or not, that’s all it takes. Only interested in the instances of Microsoft Word that are running on your computer? Then call Get-Process followed by the executable file name (without the file extension). In other words:

Get-Process winword

That results in output similar to this:

Handles  NPM(K)    PM(K)      WS(K) VM(M)   CPU(s)     Id ProcessName
-------  ------    -----      ----- -----   ------     -- -----------
    565      25    48760      77744   537   241.34   3116 WINWORD

Want to get back more than one process? Then just specify more than one executable name, separating the names with commas:

Get-Process winword,explorer

This time around your output will return information about both Word and Windows Explorer:

Handles  NPM(K)    PM(K)      WS(K) VM(M)   CPU(s)     Id ProcessName
-------  ------    -----      ----- -----   ------     -- -----------
    497      16    18524      28264    96     8.30   1080 explorer
    565      25    48760      77744   537   241.34   3116 WINWORD

Alternatively, you can use a wildcards to retrieve information about, say, all the running processes whose executable file name starts with the letter w:

Get-Process w*

With this command you get back pretty much what you’d expect to get back:

Handles  NPM(K)    PM(K)      WS(K) VM(M)   CPU(s)     Id ProcessName
-------  ------    -----      ----- -----   ------     -- -----------
     65       2     1628       1836    15     0.03   2024 wdfmgr
    557      65     8184       3824    57     1.06   1220 winlogon
    569      26    48748      77912   542   282.86   3116 WINWORD
    149       4     2024       5288    37     0.17    808 wmiprvse
     48       2      916       3404    29     0.06   2820 WZQKPICK

Although the functionality of the Get-Process cmdlet overlaps with the functionality of the WMI class Win32_Process, Get-Process can retrieve additional information not exposed through WMI, including properties such as company, file version, and product version. For example, this command pipes Get-Process through the Select-Object cmdlet, filtering out everything except the process name and the properties just mentioned:

Get-Process | Select-Object name,fileversion,productversion,company

Here’s the kind of information you can expect to get back:

Name                FileVersion         ProductVersion      Company
----                -----------         --------------      -------
alg                 5.1.2600.2180 (x... 5.1.2600.2180       Microsoft Corpor...
apdproxy            3.0.0.53237         3.0.0.53237         Adobe Systems In...
asghost             1.5.0.035           1.5                 Cognizance Corpo...
ati2evxx            6.14.10.4118        6.14.10.4118.02     ATI Technologies...

So how do you know which process properties are available through Get-Process? Probably the easiest way to determine that is to simply call Get-Process and then pipe the returned information through the Get-Member cmdlet:

Get-Process | Get-Member

That will return a list of all of the cmdlet’s properties and methods.

Related Links

• More Cmdlets