16 August 2012

Find process owner

In order to find a process owner you must use WMI;

(Get-WmiObject -Class win32_process |Where-Object {$_.name -eq 'powershell.exe'}).getowner().user

to retrive all processes owned by a user:

Get-WmiObject -Class win32_process | Where-Object {$_.getowner().user -eq 'username'}

2 comments:

  1. Good Morning,
    thanks for the snippet but it is not getowner().username!

    This is the right Snippet
    (Get-WmiObject -Class win32_process |Where-Object {$_.name -eq 'wininit.exe'}).getowner().User

    Have a nice Day

    ReplyDelete