Scripting Task Manager Processes PowerShell’s Get-Process

Introduction PowerShell Get-Process

The purpose of this page is two-fold; firstly, to provide ‘how to’ examples for scripting Windows processes.  Secondly, to help those who want to learn more about PowerShell’s Get-Process command, methods and syntax.

Topics for The PowerShell Get-Process Cmdlet

• Our Mission
• Example 1: Listing with Get-Process
• Example 2: Controlling the Output of Get-Process
• Example 3: Get-Process in Action
• Meet the Process Family
• Stop-Process
• Summary of PowerShell Get-Process

 ♣

Our Mission

One useful skill for all computer users is to check, and if necessary, Kill a process.  Such processes are listed in the Task Manager, and this leads me to another useful learning technique, have the GUI (Task Manager) open so that you can trace precisely what the PowerShell script achieves.

Preparation – Launch Task Manager

It’s time to launch the Task Manager; the flashiest way is to press Ctrl +Shift +Esc; next click on the Processes tab, if you click on ‘Image Name’, then you can sort the processes into alphabetical order.  Incidentally, when troubleshooting which Process is hogging the processor, I maximize the Task Manager window, then click on the CPU column.  The result is the process with the greatest value for CPU comes to the top of the list.

Example 1: Listing with Get-Process

PowerShell Pre-requisites and Checklist

In the case of Windows 7 and later, you don’t need to download any extra files, just: ‘Add Feature’ –> Windows PowerShell.  However, for older operating systems, there are different versions of PowerShell for XP, Windows Server 2003 and Vista.  For such legacy systems only, you need to download PowerShell from Microsoft’s site.

Once you have installed PowerShell 2.0 or later, I recommend choosing the ISE (Integrated Scripting Engine) version, it will save buying a text editor.

Learning Points

Note 1:  PowerShell’s commands are not case sensitive, thus you could type Get-Process, or Get-Process.  Also you can omit the ‘get’ in Get-Process, this is because ‘get’ is the default verb and PowerShell intelligently adds ‘Get-‘ to process.

Note 2:  Invariably, PowerShell uses singular nouns, thus Get-Process (and not Get-Processes).

Switches or modifiers for Get-Process

With Get-Process, the wildcard asterisk * is optional, however, it does remind us that we can modify the output to produce a restricted range:

Get-Process [ab]* returns all processes beginning with the letter a or b.

Get-Process [ae]* surprised me, it only listed process beginning with ‘a’, or beginning with ‘e’.  To get a range we must add a hyphen between the letters: Get-Process [a-e]*

If you have taken my advice and you have the Task Manager open, it’s worth checking that what you see in PowerShell matches what you see in Task Manager.

Guy Recommends:  A Free Trial of the Network Performance Monitor (NPM) v11.5

SolarWinds’ Network Performance Monitor will help you discover what’s happening on your network.  This utility will also guide you through troubleshooting; the dashboard will indicate whether the root cause is a broken link, faulty equipment or resource overload.

What I like best is the way NPM suggests solutions to network problems.  Its also has the ability to monitor the health of individual VMware virtual machines.  If you are interested in troubleshooting, and creating network maps, then I recommend that you try NPM now.

Download a free trial of Solarwinds’ Network Performance Monitor

Example 2: Controlling the Output of Get-Process

Once again, it is worth inspecting the Task Manager as you learn about Get-Process, in particular examine the column headings, Image Name, PID, CPU etc.  Indeed, if you click on the View menu, then Select Columns you can add yet more columns.  What helps to make connections is to compare those columns with properties displayed by PowerShell’s Get-Member command.  Incidentally, every PowerShell command benefits from the following Get-Member ‘treatment’.

Properties for PowerShell Get-Process

Here is a useful command called Get-Member, which displays the process properties.  From the resulting list you can decide which to employ in your PowerShell task.

I like to add a filter so that the command just lists the Properties.
Get-Process | Get-Member -MemberType Property

Useful properties of process include CPU, WorkingSet, VirtualMemorySize, HandleCount and Company.

For later reference, you could save the information to file.
Get-Process | Get-Member -MemberType Property | out-file Process.txt

See basic PowerShell examples featuring Get-Process

Guy Recommends: SolarWinds Engineer’s Toolset v10

This Engineer’s Toolset v10 provides a comprehensive console of 50 utilities for troubleshooting computer problems.  Guy says it helps me monitor what’s occurring on the network, and each tool teaches me more about how the underlying system operates.

There are so many good gadgets; it’s like having free rein of a sweetshop.  Thankfully the utilities are displayed logically: monitoring, network discovery, diagnostic, and Cisco tools.  Try the SolarWinds Engineer’s Toolset now!

Download your fully functional trial copy of the Engineer’s Toolset v10

Example 3: PowerShell Get-Process in Action

Example 3a – Format-Table

Note  Out-GridView: PowerShell v 2.0 introduces a new cmdlet to control data display.  See more on how to pipe the results into out-GridView.

Learning Points

In this example, the display of the output is controlled by Format-Table.  Following research with Get-Member, you can decide which properties to add, and which to delete from my example.

Example 3b – List the companies who are responsible for the processes

Learning Points

Such a script could be the basis of detecting rogue programs.  Once you have a list of companies you could check for suspicious or unknown names.

Example 3c – List the companies who are responsible for the processes

Learning Points

Here is a variation of Example 3b.  My idea is to format the output as a table, and then apply the -groupby command to aggregate the company information.  Incidentally, PowerShell provides information about ‘company’ that is not available from the Task Manager’s Processes tab.

From a pure PowerShell point of view, observe the two pipelines (|) in the cmdlet.  This example also features group-Object and Sort-Object.  In addition to improving the output, these handy verbs can be truncated to ‘group’ or ‘sort’, PowerShell intelligently deduces the noun, -object.

Example 3d – Filter processes with over 200 handles

Learning Points

The purpose of this command is to filter the processes.   $_.  is a placeholder, or reference to the current command, or the first pipeline.  From a PowerShell point of view, many script benefit from a ‘Where’ clause to filter the output.  Take the time to check where to place the (|) pipe, and also to admire the $_. construction, which means ‘in this pipeline’

Guy Recommends:  SolarWinds’ Free Bulk Import Tool

Import users from a spreadsheet.  Just provide a list of the users with their fields in the top row, and save as .csv file.  Then launch this FREE utility and match your fields with AD’s attributes, click and import the users.

Optionally, you can provide the name of the OU where the new accounts will be born. Download your FREE bulk import tool.

Stop-Process Alias Spps

With Microsoft, there are always at least three ways of doing everything, what seems like redundancy when you are an expert, seems like perspective when you are a beginner.  One obvious example is that you can abbreviate Format-Table to ft.  As you increase your range of PowerShell commands, keep an eye out for another PowerShell Alias, for example gci (Get-Childitem).

Meet the Process Family

In addition to Get-Process, which is featured on this page, there are sister commands: start-Process and stop-Process.  Here is a classic example of PowerShell’s consistency, learn how the noun ‘Process’ is controlled by the verbs, start, stop and get, then apply those same verbs to the noun ‘Service’.

If you explore with Get-Process then something magical will happen. Task Manager processes will help you learn PowerShell commands, while the research needed to get PowerShell scripts to work, will teach you more about the operating system’s processes.

Summary of the PowerShell Get-Process Cmdlet

Get-Process is a good place to start experimenting with the syntax of the new Microsoft Shell.  As you try the various PowerShell commands, look out for Verb-Noun pairs such as Get-Process.  In this example, examine PowerShell techniques such as pipeline, Get-Member and also Format-Table.  One real life task is to check the company names associated with processes, and thus spot an impostor, a virus, or annoying grayware.

Next – Stop-Process (Kill a Windows Process) »

See more PowerShell examples of process and service

• PowerShell Home   • Get-Process   • Stop-Process   • PowerShell Start-Process   • Set-Service

• Get-Service   • Start-Service   • Stop-Service   • Restart-Service   • Free WMI Monitor

• PowerShell Start-Sleep   • Get-WmiObject win32_service   • Windows PowerShell

Please email me if you have a better example script. Also please report any factual mistakes, grammatical errors or broken links, I will be happy to correct the fault.