Display, retrieve, and terminate Windows processes with PowerShell

If you want to display only processes that begin with the letter “s”, you can use the * wildcard to filter the list. To do this, type the following command:

Get-Process s*

In the same way, you can perform all other filtering by letter. For example, if you want to display all processes in which the string “sql” occurs, you can use the following command (see Figure 1):

Get-Process *sql*

Fig. 1: By using filters, Get-Process not only lists processes, but also filters them.

Get-Process can sort processes not only alphabetically by name, but also, for example, based on their resource consumption. If you want to filter and sort processes by name and by resource consumption, for example, descending by CPU time, first type Get-Process s* and use Pipe to forward the result to Sort-Object with the option |Sort-Object cpu -Descending:

Get-Process s*|Sort-Object cpu -Descending

In this way, processes can be effectively filtered and sorted for display.

You can also display more detailed information for individual processes that are not displayed in the aggregated list. To do this, you first use Get-Process to display an overview of the processes that you want to see, and then you use the pipe to pass this result to the Format-List cmdlet. You can use the * wildcard to ensure that all information about the processes is displayed.

Here is an example that generates a detailed listing of the “winword” and “explorer” processes as output

Get-Process winword, explorer | Format-List *

Instead of typing the command “Format-List”, you can also work with the abbreviation “fl”:

Get-Process winword, explorer | fl *

If you do not want to display all details but only certain details, you can also enter the name of the corresponding column instead of the wildcard * for “fl *”, for example:

Get-Process winword, explorer | fl Name, PriorityClass, FileVersion

Instead of a formatted list (|fl *), you can also have the results displayed in a formatted table. To do this, use the Format-Table or “ft” cmdlet for the right part of the pipeline (see Figure 2).

Fig. 2: Controlling the display of a PowerShell command

Fig. 3: Opening a PowerShell session to manage processes on a remote computer

Fig. 4: By using -Confirm, you can tell PowerShell not to terminate processes until you get confirmation

But the most important advantage is that by using PowerShell, this data and information becomes accessible to other systems. For example, automated monitoring can be built on the basis of a script for Windows process monitoring. This reduces the manual and time-consuming effort in administration to a minimum.