In order to find a process owner you must use WMI;
(Get-WmiObject -Class win32_process |Where-Object {$_.name -eq 'powershell.exe'}).getowner().user
to retrive all processes owned by a user:
Get-WmiObject -Class win32_process | Where-Object {$_.getowner().user -eq 'username'}
Good Morning,
ReplyDeletethanks for the snippet but it is not getowner().username!
This is the right Snippet
(Get-WmiObject -Class win32_process |Where-Object {$_.name -eq 'wininit.exe'}).getowner().User
Have a nice Day
thanks - i will modify it;
Delete