94

e.g: if I run notepad.exe c:\autoexec.bat,

How can I get c:\autoexec.bat in Get-Process notepad in PowerShell?

Or how can I get c:\autoexec.bat in Process.GetProcessesByName("notepad"); in C#?

4
  • Maybe this will help you: How to get the command line parameters from a different process
    – Corak
    Jul 10, 2013 at 6:08
  • its not clear. can u specify more clearly what exactly you are trying to do? @victorwoo
    – Rezoan
    Jul 10, 2013 at 6:09
  • 1
    Please take a step back and describe the actual problem you're trying to solve instead of what you perceive as the solution. Jul 10, 2013 at 9:40
  • 1
    If we've started a process and passed some parameters, how to get the command line parameters of the running process by C# or PowerShell?
    – victorwoo
    Jul 10, 2013 at 10:10

4 Answers 4

151

In PowerShell you can get the command line of a process via WMI:

$process = "notepad.exe"
Get-WmiObject Win32_Process -Filter "name = '$process'" | Select-Object CommandLine

Note that you need admin privileges to be able to access that information about processes running in the context of another user. As a normal user it's only visible to you for processes running in your own context.

10
  • 9
    There is a permissions aspect to this too. The Powershell process needs to have permissions at least equivalent to the target process. So a regular Powershell session won't be able to get such information for a process running elevated (e.g. as Administrator). in this case, CommandLine (the response) will just be blank.
    – CJBS
    Feb 18, 2014 at 19:18
  • 4
    @CJBS To be precise you need admin privileges to be able to access that information about processes running in the context of another user. As a normal user it's only visible to you for processes running in your own context. Feb 18, 2014 at 22:15
  • 7
    The value is still truncated to a certain length of characters. You can work around it by piping the result to "out-string -Width 2000" or something similar.
    – Shannon
    Jun 17, 2014 at 22:47
  • 11
    @mbrownnyc Using -Filter does the filtering on the remote host if your run Get-WmiObject against remote computers (using the -ComputerName parameter), reducing the amount of data that is transferred over the network (thus improving performance). Using Where-Object filters locally, after all WMI data was fetched from the remote host(s). It doesn't make a difference when running Get-WmiObject locally, though, like in this case. Also note that the syntax where property <op> value only works in PowerShell v3 or newer. Prior to that you must use where { $_.property <op> value }. Jul 18, 2015 at 10:44
  • 3
    This didn't take much to figure out, but to save someone a few keystrokes, if you already have the process id (like from looking at CPU usage, etc) you can use "processid = 1234" - I use it for seeing which website is going rogue on our server (and there are 200 w3wp.exe processes)
    – ahwm
    Jul 14, 2017 at 17:32
57

This answer is excellent, however for futureproofing and to do future you a favor, Unless you're using pretty old powershell (in which case I recommend an update!) Get-WMIObject has been superseded by Get-CimInstance Hey Scripting Guy reference

Try this

$process = "notepad.exe"
Get-CimInstance Win32_Process -Filter "name = '$process'" | select CommandLine 
2
  • 14
    Note that with Get-CimInstance Win32_Process, the name includes the .exe extension. That's different from Get-Process. Oct 10, 2019 at 21:02
  • Or, if you want to use PIDs: get-process node | select id,starttime,name,@{Name="CommandLine";Expr={ $filter = "ProcessId = {0}" -f $_.Id; (Get-CimInstance Win32_Process -filter $filter).CommandLine }} | sort starttime | ft -au -wr
    – JohnL4
    Mar 16 at 15:57
13

if you put the following code in your powershell $profile file you can permanently extend the "process" object class and use the "CommandLine" property

example:

get-process notepad.exe | select-object ProcessName, CommandLine

code:

$TypeData = @{
    TypeName = 'System.Diagnostics.Process'
    MemberType = 'ScriptProperty'
    MemberName = 'CommandLine'
    Value = {(Get-CimInstance Win32_Process -Filter "ProcessId = $($this.Id)").CommandLine}
}
Update-TypeData @TypeData
8

I'm using powershell 7.1 and this seems to be built in to the process object now as a scripted property:

> (Get-Process notepad)[0].CommandLine
"C:\WINDOWS\system32\notepad.exe"

Interestingly, you can view its implementation and see that it partially uses the answer from PsychoData:

($process | Get-Member -Name CommandLine).Definition
System.Object CommandLine {get=
                        if ($IsWindows) {
                            (Get-CimInstance Win32_Process -Filter "ProcessId = $($this.Id)").CommandLine
                        } elseif ($IsLinux) {
                            Get-Content -LiteralPath "/proc/$($this.Id)/cmdline"
                        }
                    ;}

Running Get-Member on a process shows that it is an instance of System.Diagnostics.Process, but that it has several properties that are scripted.

The other properties are FileVersion, Path, Product, and ProductVersion.

1
  • 1
    Appreciated the idea to use Get-Member to get more details on how pwsh works. We can also use $process | Get-TypeData | ConvertTo-Json for similar reasons.
    – minus one
    Feb 2, 2021 at 11:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.