--- title: "Steamy PowerShell Get-Process Cmdlet for Running Processes" description: "Use the PowerShell Get-Process cmdlet to learn in-depth information on local and remote processes on both Windows and Linux." canonical: "https://adamtheautomator.com/powershell-get-process/" --- # Steamy PowerShell Get-Process Cmdlet for Running Processes > Use the PowerShell Get-Process cmdlet to learn in-depth information on local and remote processes on both Windows and Linux. Source: https://adamtheautomator.com/powershell-get-process/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![Steamy PowerShell Get-Process Cmdlet for Running Processes](https://adamtheautomator.com/wp-content/uploads/2021/02/How-to-Find-Running-Processes-the-with-PowerShells-Get-Process-Cmdlet.jpg) # Steamy PowerShell Get-Process Cmdlet for Running Processes [![](https://secure.gravatar.com/avatar/4147968aa2332aa682bcebf295e4e9d0eb2672dee3d9ae0523a00ac51e7d6017?s=192&d=mm&r=g)Bill Kindle](https://adamtheautomator.com/author/bill/)15 February 20216 min. read Categories: [IT Ops](/category/it-ops/) Tags:[PowerShell](/tag/powershell/) Table of Contents * [Prerequisites](#h-prerequisites) * [Displaying Running Processes](#h-displaying-running-processes) * [Finding Specific Process Attributes](#h-finding-specific-process-attributes) * [Retrieving Process Memory Usage](#h-retrieving-process-memory-usage) * [Exposing Lesser-Known Properties](#h-exposing-lesser-known-properties) * [Discovering Where a Process Binary Lives](#h-discovering-where-a-process-binary-lives) * [Finding the Process Owner](#h-finding-the-process-owner) * [Finding Processes on Remote Computers](#h-finding-processes-on-remote-computers) * [Next Steps](#h-next-steps) Interested in using the [PowerShell Get-Process](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-process?view=powershell-7.1) cmdlet to display the running processes of a system? With `Get-Process` you can find the process owner, the process ID, or even where on disk the process is located. In this article, you will learn how to use PowerShell’s `Get-Process` cmdlet through real-world examples. If wrangling processes to bend them to your will on Windows or Linux sounds like fun, then keep reading! **_Related: [How to Kill a Process in Linux Using ps, pgrep, pkill and more!](https://adamtheautomator.com/linux-kill-process/)_** ## Prerequisites Before going any further, below are the necessary prerequisites to follow along with the examples in this article. * Although Windows PowerShell 5.1 is sufficient for most examples here, [PowerShell 7.1 and greater](https://github.com/PowerShell/powershell/releases) is necessary for Linux support. **_Related: [Upgrading to PowerShell 7: A Walkthrough](https://adamtheautomator.com/powershell-7-upgrade/)_** * This article uses Windows 10 and Ubuntu 20.04 LTS, but any OS that PowerShell runs on will work. Ready? Let’s dive in and manage some processes! ## Displaying Running Processes `Get-Process` manages local processes. In this first example, you are using the PowerShell Get-Process `c`mdlet. This command displays all running processes. > _`Get-Process` returns a point-in-time snapshot of a system’s running process information. To display real-time process information Windows offers [Windows Task Manager](https://docs.microsoft.com/en-us/cpp/atl/using-task-manager?view=msvc-160) and Linux offers the [top](https://man7.org/linux/man-pages/man1/top.1.html) command._ To get started, open up your PowerShell console and run `Get-Process`. Notice, that `Get-Process` returns the running process information, as shown below. The output format is identical for the Windows and Linux operating systems. ![Using the Get-Process cmdlet on Windows to display local processes.](https://adamtheautomator.com/wp-content/uploads/2021/02/Untitled-2021-02-14T213003.368.png) Using the `Get-Process` cmdlet on Windows to display local processes. > _By default, the `gps` or `ps` exist as command aliases for `Get-Process`. As PowerShell 7 is cross-platform, the `ps` command conflicts with a [built-in Linux command](https://man7.org/linux/man-pages/man1/ps.1.html). Therefore `ps` will not work on Linux, only the `gps` alias._ The meaning of `Get-Process` output may not be immediately obvious. The default `Get-Process` properties are described in more detail below. * **NPM(K)** – The amount of non-paged memory a process is using, displayed in kilobytes, as indicated by the `(K)` notation. * **PM(M)** – The amount of pageable memory a process is using, displayed in megabytes, as indicated by the `(M)` notation. * **WS(M)** – The size of the working set of the process, displayed in megabytes. The working set consists of the pages of memory that were recently referenced by the process. * **VM(M)** – The amount of virtual memory that the process is using, displayed in megabytes. Includes storage in the paging files on disk. * **CPU(S)** – The amount of processor time that the process has used on all processes, displayed in seconds. * **Id** – The process ID (PID) of the process. * **SI** – Session Identifier of the running process. Session `0` indicates the process is available for all users, `1` indicates the process exists under the first logged in user, and so on. * **ProcessName** – The name of the running process. > _To display a list of property aliases mapped to full property names, use the command `Get-Process | Get-Member -MemberType 'AliasProperty'`._ Below is another great example. For each instance of the _brave_ process it finds, it uses that process’s ID (`$_.id`) and passes it to [`Get-NetTCPConnection`](https://docs.microsoft.com/en-us/powershell/module/nettcpip/get-nettcpconnection?view=win10-ps%3E). PowerShell then uses `Get-NetTCPConnection` to find information about each network connection the _brave_ process has open. Run the following code in your PowerShell session when the [Brave browser](https://brave.com/) is running. ```powershell Get-Process -Name brave | ForEach-Object { Get-NetTCPConnection -OwningProcess $_.Id -ErrorAction SilentlyContinue } ``` Thank you to [Jay Adams](https://www.linkedin.com/in/jay-adams-523a6a24/) over at [SystemFrontier](https://www.systemfrontier.com/solutions/powershell/)! Congratulations, you can now view all the running processes on both Windows and Linux using `Get-Process`! ## Finding Specific Process Attributes `Get-Process` returns many different properties on running processes as you have seen earlier. Like with all other PowerShell objects, you can selectively pick out properties on objects. Let’s now step through a simple example of how you can retrieve specific properties for a specific process: 1. Fire up your Windows calculator. 2\. With a PowerShell console open, run `Get-Process` using the `Name` parameter to only show all running processes with _Calculator_ as the name. You’ll see the same output you’ve seen previously. ```powershell Get-Process -Name 'Calculator' ``` `Get-Process` returns many properties as expected. Maybe you only want to find CPU utilization with the value under the `CPU(s)` column. Surround the `Get-Process` command with parentheses and reference the `CPU` property as shown below. You’ll see that it only returns the value for the `CPU` property. ```powershell (Get-Process -Name 'Calculator').CPU ``` > _Notice that `Get-Process` returns a name called `CPU(s)` and the code snippet above used the name of just `CPU`. Sometimes PowerShell doesn’t show the real property name in the output. This concept is performed with a [PS1XML formatting file](https://docs.microsoft.com/en-us/powershell/scripting/developer/format/how-to-create-a-formatting-file-format-ps1xml)._ The CPU time is expressed as a total of seconds across cores. To get that to a more human-readable number, [round it to the nearest tenth using a `Math` method](https://devblogs.microsoft.com/scripting/powertip-use-powershell-to-round-to-specific-decimal-place/) as shown below. ```powershell $cpu = (Get-Process -Name 'Calculator').CPU [math]::Round($cpu,2) ``` ![Calculator process is using less than 1 second of CPU time across all cores.](https://adamtheautomator.com/wp-content/uploads/2021/02/Untitled-2021-02-14T213506.018.png) Calculator process is using less than 1 second of CPU time across all cores. > _You can use the above approach to find any other properties too like `Id` if you’d like to only see a process’ ID._ Leave the _Calculator_ application running. You’ll be using this application for the remainder of the examples. ## Retrieving Process Memory Usage Troubleshooting slow running systems can be a challenge, with constrained memory often a cause. Continuing with the _Calculator_ app, retrieve the `Calculator` process, and display only the `VM` property. As seen below, the memory used is displayed in megabytes (MB). ```powershell (Get-Process -Name 'Calculator').VM ``` ![Displaying the Calculator process memory usage.](https://adamtheautomator.com/wp-content/uploads/2021/02/Untitled-2021-02-14T213546.161.png) Displaying the `Calculator` process memory usage. To aid in understanding the memory usage, utilize the [built-in PowerShell conversion multipliers](https://www.powershellmagazine.com/2013/05/20/converting-to-size-units-kb-mbgbtb-and-pb-without-using-powershell-multipliers/) to change megabytes (MB) to gigabytes (GB). In the below example, you will convert the memory used to GB and then use the [.NET math library](https://mcpmag.com/articles/2018/01/10/math-with-powershell.aspx) `Round` method to round the value, as seen in the below screenshot. ```powershell $ProcessMemoryGB = (Get-Process -Name 'Calculator').VM $ProcessMemoryGB / 1GB # Use the .NET Math type Round method [Math]::Round($ProcessMemoryGB / 1GB) ``` Using built-in PowerShell utilities to convert the values makes it easier to understand the output. Read on to learn how to locate a process’s ID. ![Converting the calculator process memory usage to a rounded GB format.](https://adamtheautomator.com/wp-content/uploads/2021/02/Untitled-2021-02-14T213619.635.png) Converting the calculator process memory usage to a rounded GB format. ## Exposing Lesser-Known Properties Not all properties are included or shown by default with `Get-Process`. Read on below to learn more about the `Path` and `UserName` properties and how to use them! ### Discovering Where a Process Binary Lives There are many places on a system that a process executable can be stored. If a process is currently running, `Get-Process` makes finding the process file system path easy, despite `Path` not displaying by default. As shown below, the `Path` property contains the filesystem location of the process executable. ```powershell (Get-Process -Name 'Calculator').Path ``` ![Using Get-Process to display a process's full file system path on Windows.](https://adamtheautomator.com/wp-content/uploads/2021/02/Untitled-2021-02-14T213652.304.png) Using `Get-Process` to display a process’s full file system path on Windows. Just as in Windows, `Get-Process` in Linux also returns the filesystem path. In the example below, the `gnome-calculator` process is running with the path displayed in the console output. ```powershell (Get-Process -Name 'gnome-calculator').Path ``` ![Using Powershell Get-Process to display a process's full file system path on Linux.](https://adamtheautomator.com/wp-content/uploads/2021/02/Untitled-2021-02-14T213720.455.png) Using Powershell `Get-Process` to display a process’s full file system path on Linux. Crafty bad actors may name a process the same or similar as a trusted one. Therefore, the ability to locate the filesystem path aids in a [security incident response (IR) scenario](https://www.cybertriage.com/2019/how-to-detect-running-malware-intro-to-incident-response-triage-part-7/). Read on to discover how to locate the process owner, as `UserName` is not included in the default output. ### Finding the Process Owner To include the `UserName` value in the output, you will need to use the `IncludeUserName` parameter. It is important to know the process owner, especially to avoid unwittingly terminating another user’s process. As shown below, the `UserName` property is now included in the process output. ```powershell Get-Process -Name 'Calculator' -IncludeUserName ``` ![Displaying the owner of Calculator process on Windows.](https://adamtheautomator.com/wp-content/uploads/2021/02/Untitled-2021-02-14T213747.038.png) Displaying the owner of `Calculator` process on Windows. Finally, read on to learn about using `Get-Process` on a remote computer to retrieve process information! ## Finding Processes on Remote Computers Although in Windows PowerShell, `Get-Process` doesn’t have any remote capabilities on its own, you can always leverage [PowerShell Remoting](https://adamtheautomator.com/psremoting/ "PowerShell Remoting") and the `Invoke-Command` to run it on remote computers. **_Related: [How to Set up PSRemoting with Windows and Linux](https://adamtheautomator.com/psremoting-linux/)_** But, if you’re on Linux or are running PowerShell 6 on Windows, you now have a `ComputerName` parameter you can use to query processes on remote computers. ```powershell Get-Process -ComputerName 'remote_computer_name' -ProcessName 'process' ``` > _The `-ComputerName` parameter was removed in PowerShell 7.x as the cmdlet is not directly related to remoting. To achieve the same, you can wrap the same in an `Invoke-Command`, like so: `Invoke-Command -ComputerName "ComputerName" -ScriptBlock { Get-Process -ProcessName 'process' }`_ When the above command is run against a remote computer, the same output is shown as if the `Get-Process` command was run locally. Below is an example of remoting to another computer and getting running processes: ![Computer and Getting Running Processes](https://adamtheautomator.com/wp-content/uploads/2021/02/Untitled-2021-02-14T213819.827.png) Computer and Getting Running Processes > _You can target multiple computers by separating them with a comma e.g. `Get-Process -ComputerName SRV1,SRV2.`_ ## Next Steps In this article, you’ve learned how to use the [PowerShell `Get-Process`](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-process?view=powershell-7.1#parameters) cmdlet to find running processes with PowerShell on local and remote computers both Linux and Windows. Now, what will you do with this knowledge? Try passing a process retrieved by `Get-Process` to `Stop-Process` on a local or remote computer to terminate! Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fpowershell-get-process%2F&text=Steamy%20PowerShell%20Get-Process%20Cmdlet%20for%20Running%20Processes)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fpowershell-get-process%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fpowershell-get-process%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/2026/06/26995-troubleshoot-dns-issues-powershell-codex.webp) ### [Troubleshoot DNS Issues with PowerShell](/troubleshoot-dns-issues-powershell/) Troubleshoot DNS issues with PowerShell by testing name resolution, DNS client settings, cache entries, and network connectivity in a repeatable workflow. ![](https://adamtheautomator.com/wp-content/uploads/2025/10/image_2025-10-24_095322075.png) ### [Migrating from PowerShell 6 to 7.5: Breaking Changes/New Features](/migrating-powershell-6-to-7-5/) Migrate from PowerShell Core 6 to 7.5: breaking changes, features, and testing tips. ![](https://adamtheautomator.com/wp-content/uploads/2025/06/featured-image-6.png) ### [How to Add Timeouts to Pester Tests with PowerShell Runspaces](/pester-test-timeout-runspaces/) Prevent Pester tests from hanging indefinitely using PowerShell runspaces. Learn to handle variable scoping, module loading, TestDrive access, and stream capture challenges with timeout protection. ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)