Get-Process

The Get-Process cmdlet gets the processes on a local or remote computer.

Without parameters, this cmdlet gets all processes on the local computer. You can also specify a specific process by process name or process ID (PID), or by piping a System.Diagnostics.Process object to this cmdlet.

By default, this cmdlet returns a Process object that has detailed information about the process and supports methods that let you control it. With parameters, you can change the type of information returned by this cmdlet.

• Module: Retrieve information for each module loaded into the process.
• FileVersionInfo: Retrieve file version information for the main module of the process.

Get-Process

This command gets a list of all running processes on the local computer. For a definition of each display column, see the NOTES section.

To see all properties of a Process object, use Get-Process | Get-Member. By default, PowerShell displays certain property values using units such as kilobytes (K) and megabytes (M). The actual values when accessed with the member-access operator (.) are in bytes.

Get-Process winword, explorer | Format-List *

This pipeline displays detailed information about the winword and explorer processes on the computer. It uses the Name parameter to specify the processes, but it omits the optional parameter name. The pipeline operator (|) pipes Process objects to the Format-List cmdlet, which displays all available properties (*) and their values for each object.

You can also identify the processes by their process IDs. For instance, Get-Process -Id 664, 2060.

Get-Process | Where-Object { $_.WorkingSet -gt 20971520 }
Get-Process | Where-Object WorkingSet -GT 20MB

The Get-Process cmdlet returns the running processes. The output is piped to the Where-Object cmdlet, which selects the objects with a WorkingSet value greater than 20,971,520 bytes.

In the first example, Where-Object uses a scriptblock to compare the WorkingSet property of each Process object. In the second example, the Where-Object cmdlet uses the simplified syntax to compare the WorkingSet property. In this case, -GT is a parameter, not a comparison operator. The second example also uses a numeric literal suffix as a concise alternative to 20971520. In PowerShell, MB represents a mebibyte (MiB) multiplier. 20MB is equal to 20,971,520 bytes.

$processes = Get-Process
$processes | Sort-Object { $_.PriorityClass } | Format-Table -View Priority

These commands display processes on the computer in groups based on their priority class. The first command gets all processes on the computer and stores them in the $processes variable.

The second command pipes the Process objects stored in the $processes variable to the Sort-Object cmdlet, then to the Format-Table cmdlet, which formats the processes using the Priority view.

The Priority view, and other views, are defined in the .ps1xml format files in the PowerShell home directory ($PSHOME).

Get-Process -Name powershell | Format-Table -Property @(
    'Handles'
    @{ Name = 'NPM(K)'; Expression = { [int] ($_.NPM / 1KB) } }
    @{ Name = 'PM(K)';  Expression = { [int] ($_.PM / 1KB) } }
    @{ Name = 'WS(K)';  Expression = { [int] ($_.WS / 1KB) } }
    @{ Name = 'CPU(s)'; Expression = { if ($_.CPU) { $_.CPU.ToString('N') } } }
    'Id'
    @{ Name = 'SI'; Expression = 'SessionId' }
    'ProcessName'
    'StartTime'
) -AutoSize

Handles NPM(K) PM(K) WS(K) CPU(s)   Id SI ProcessName StartTime
------- ------ ----- ----- ------   -- -- ----------- ---------
    655     34 69424 83424 2.20   4240  1 powershell  4/14/2025 10:40:10 AM
    572     36 68768 57260 7.41   4968  1 powershell  4/13/2025 3:33:50 PM
    405     26 38144 30340 1.80   8776  1 powershell  4/14/2025 9:54:27 AM

This example retrieves processes from the local computer and pipes each Process object to the Format-Table cmdlet. Format-Table recreates the default output display of a Process object using a mixture of property names and calculated properties. The display includes an additional StartTime property not present in the default display.

Get-Process -Name powershell -FileVersionInfo

ProductVersion   FileVersion      FileName
--------------   -----------      --------
10.0.19041.320   10.0.19041.32... C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

This command uses the FileVersionInfo parameter to get file version information for the main module of the powershell process. The main module is the file used to start the process, which in this case is powershell.exe.

To use this command with processes that you don't own on Windows Vista and later versions of Windows, you must run PowerShell with elevated user rights (Run as administrator).

Get-Process -Name SQL* -Module

This command uses the Module parameter to get the modules loaded by all processes with a name beginning with SQL.

To use this command with processes that you don't own on Windows Vista and later versions of Windows, you must run PowerShell with elevated user rights (Run as administrator).

Get-Process -Name powershell -IncludeUserName

Handles      WS(K)   CPU(s)     Id UserName            ProcessName
-------      -----   ------     -- --------            -----------
    782     132080     2.08   2188 DOMAIN01\user01     powershell

Get-CimInstance -ClassName Win32_Process -Filter "name='powershell.exe'" |
    Invoke-CimMethod -MethodName GetOwner

Domain   ReturnValue User   PSComputerName
------   ----------- ----   --------------
DOMAIN01           0 user01

The first command shows how to get the owner of a process. The IncludeUserName parameter requires elevated user rights (Run as Administrator). The output reveals that the owner is DOMAIN01\user01.

The second pipeline shows a different way to get the owner of a process using Get-CimInstance and Invoke-CimMethod. The Win32_Process class with a filter retrieves powershell processes and the invoked GetOwner() method returns information on the process's Domain and User. This method doesn't require elevated user rights.

Get-Process -Name powershell

Handles  NPM(K)    PM(K)      WS(K)     CPU(s)     Id  SI ProcessName
-------  ------    -----      -----     ------     --  -- -----------
    561      44    47564      40740       6.48   2604   1 powershell
    642      40    72040      24372      23.53   3576   1 powershel

Get-Process -Id $PID

Handles  NPM(K)    PM(K)      WS(K)     CPU(s)     Id  SI ProcessName
-------  ------    -----      -----     ------     --  -- -----------
    647      40    72464      30716      23.67   3576   1 powershell

These commands show how to use the $PID automatic variable to identify the process that's hosting the current PowerShell session. You can use this method to distinguish the host process from other powershell processes that you might want to control.

The first command gets all powershell processes running. The second command gets the powershell process that's hosting the current session.

Get-Process |
    Where-Object -Property MainWindowTitle |
    Format-Table -Property Id, Name, MainWindowTitle -AutoSize

This pipeline gets all processes that have a main window title, and displays them in a table with the process ID and name.

MainWindowTitle is one of many useful properties of the Diagnostics.Process object type that Get-Process returns. To view all properties, use Get-Process | Get-Member.

Process

You can pipe Process objects to this cmdlet.

Process

By default, this cmdlet returns a System.Diagnostics.Process object.

FileVersionInfo

If you use the FileVersionInfo parameter, this cmdlet returns a System.Diagnostics.FileVersionInfo object.

ProcessModule

If you use the Module parameter, without the FileVersionInfo parameter, this cmdlet returns a System.Diagnostics.ProcessModule object.

Windows PowerShell includes the following aliases for Get-Process:

• gps
• ps

On computers running 64-bit Windows, the 64-bit version of PowerShell gets the main module and 64-bit process modules. The 32-bit version of PowerShell gets only 32-bit process modules.

To get process information from a remote computer, use the Invoke-Command cmdlet. For more information, see Invoke-Command.

You can use the Windows Management Instrumentation (WMI) Win32_Process class in PowerShell as an alternative to Get-Process. For more information, see:

• Example 8: Find the owner of a process
• Get-CimInstance

The default display of a Process object is a table view that includes the following columns.

• Handles: The number of handles that the process has opened.
• NPM(K): The amount of non-paged memory that the process is using, in kilobytes.
• PM(K): The amount of pageable memory that the process is using, in kilobytes.
• WS(K): The size of the working set of the process, in kilobytes. The working set consists of the pages of memory that were recently referenced by the process.
• CPU(s): The amount of processor time that the process has used on all processors, in seconds.
• Id: The process ID (PID) of the process.
• SI: The session ID of the process.
• ProcessName: The name of the process.

You can use the built-in alternate views for Process objects available with Format-Table, such as StartTime and Priority. You can also design your own views.

For a description of all available Process object members, see Process Properties and Process Methods.