e.g: if I run notepad.exe c:\autoexec.bat
,
How can I get c:\autoexec.bat
in Get-Process notepad
in PowerShell?
Or how can I get c:\autoexec.bat
in Process.GetProcessesByName("notepad");
in C#?
e.g: if I run notepad.exe c:\autoexec.bat
,
How can I get c:\autoexec.bat
in Get-Process notepad
in PowerShell?
Or how can I get c:\autoexec.bat
in Process.GetProcessesByName("notepad");
in C#?
In PowerShell you can get the command line of a process via WMI:
$process = "notepad.exe"
Get-WmiObject Win32_Process -Filter "name = '$process'" | Select-Object CommandLine
Note that you need admin privileges to be able to access that information about processes running in the context of another user. As a normal user it's only visible to you for processes running in your own context.
-Filter
does the filtering on the remote host if your run Get-WmiObject
against remote computers (using the -ComputerName
parameter), reducing the amount of data that is transferred over the network (thus improving performance). Using Where-Object
filters locally, after all WMI data was fetched from the remote host(s). It doesn't make a difference when running Get-WmiObject
locally, though, like in this case. Also note that the syntax where property <op> value
only works in PowerShell v3 or newer. Prior to that you must use where { $_.property <op> value }
.
Jul 18, 2015 at 10:44
"processid = 1234"
- I use it for seeing which website is going rogue on our server (and there are 200 w3wp.exe
processes)
This answer is excellent, however for futureproofing and to do future you a favor, Unless you're using pretty old powershell (in which case I recommend an update!) Get-WMIObject has been superseded by Get-CimInstance Hey Scripting Guy reference
Try this
$process = "notepad.exe"
Get-CimInstance Win32_Process -Filter "name = '$process'" | select CommandLine
Get-CimInstance Win32_Process
, the name
includes the .exe extension. That's different from Get-Process
.
Oct 10, 2019 at 21:02
if you put the following code in your powershell $profile file you can permanently extend the "process" object class and use the "CommandLine" property
example:
get-process notepad.exe | select-object ProcessName, CommandLine
code:
$TypeData = @{
TypeName = 'System.Diagnostics.Process'
MemberType = 'ScriptProperty'
MemberName = 'CommandLine'
Value = {(Get-CimInstance Win32_Process -Filter "ProcessId = $($this.Id)").CommandLine}
}
Update-TypeData @TypeData
I'm using powershell 7.1 and this seems to be built in to the process object now as a scripted property:
> (Get-Process notepad)[0].CommandLine
"C:\WINDOWS\system32\notepad.exe"
Interestingly, you can view its implementation and see that it partially uses the answer from PsychoData:
($process | Get-Member -Name CommandLine).Definition
System.Object CommandLine {get=
if ($IsWindows) {
(Get-CimInstance Win32_Process -Filter "ProcessId = $($this.Id)").CommandLine
} elseif ($IsLinux) {
Get-Content -LiteralPath "/proc/$($this.Id)/cmdline"
}
;}
Running Get-Member on a process shows that it is an instance of System.Diagnostics.Process, but that it has several properties that are scripted.
The other properties are FileVersion, Path, Product, and ProductVersion.
Get-Member
to get more details on how pwsh works. We can also use $process | Get-TypeData | ConvertTo-Json
for similar reasons.
Feb 2, 2021 at 11:01