PowerShell Process Management

A process is any running instance of a program on your system. PowerShell includes a collection of *-Process cmdlets that allow you to view, launch, stop, and filter processes directly from the command line or within scripts. This makes it a powerful alternative to Task Manager.

PowerShell exposes processes as fully interactive System.Diagnostics.Process objects, enabling direct inspection of hardware metrics, memory footprint, and complete control over process lifecycles through the pipeline.

Viewing Running Processes with Get-Process

The Get-Process cmdlet returns a list of all processes currently running on the local (or a remote) computer. Each result is a .NET object (System.Diagnostics.Process), not plain text, so you can access properties like CPU, Id, WorkingSet, and ProcessName directly.

Get-Process

Handles  NPM(K)    PM(K)      WS(K)     CPU(s)     Id  SI ProcessName
-------  ------    -----      -----     ------     --  -- -----------
    542      24    18432      32100       1.23   4032   1 chrome
    312      18    12200      21500       0.45   6120   1 explorer
    128       9     4300       8900       0.11   1580   0 svchost

Getting a Specific Process

Use the -Name parameter to retrieve one or more processes by name, or -Id to retrieve a process by its Process ID (PID).

Get-Process -Name "chrome"
Get-Process -Id 4032

where:

• -Name accepts a process name (without .exe), supports wildcards like "chro*".
• -Id accepts the numeric PID of a specific process.

Get-Process -Name "notepad", "pwsh"

where:

• Get-Process: The core cmdlet used to retrieve process information.
• -Name: Specifies one or more process names to query (wildcards like * are supported; omit the .exe extension).

./get-process-demo.ps1

 NPM(K)    PM(M)    WS(M)     CPU(s)      Id  SI ProcessName
 ------    -----    -----     ------      --  -- -----------
     14     2.34    15.60       0.05    4128   1 notepad
     45    68.12    84.50       2.31    9820   1 pwsh

Launching Applications with Start-Process

The Start-Process cmdlet launches an executable, script, or document, just like double-clicking a file or running it from the Run dialog.

Start-Process -FilePath "notepad.exe"

where -FilePath is the path to the executable, script, or document to launch.

./launch-notepad.ps1

Launching with Arguments and Window Styles

Start-Process supports additional parameters for controlling how the process launches.

Start-Process -FilePath "powershell.exe" `
              -ArgumentList "-NoExit", "-Command Get-Date" `
              -WindowStyle Minimized `
              -Verb RunAs

where:

• -ArgumentList is one or more arguments passed to the executable.
• -WindowStyle controls the window state: Normal, Minimized, Maximized, or Hidden.
• -Verb RunAs launches the process elevated (equivalent to "Run as administrator").

Capturing the Process Object

$process = Start-Process -FilePath "notepad.exe" -ArgumentList "C:\Logs\app.log" -WindowStyle Maximized -PassThru

Write-Output "Launched Notepad with Process ID: $($process.Id)"

where:

• Start-Process: Initiates the execution of the target program.
• -FilePath: Specifies the full path or executable name to run.
• -ArgumentList: Passes optional command-line switches or file parameters to the binary.
• -WindowStyle: Sets the visual state of the started application (Normal, Hidden, Minimized, or Maximized).
• -PassThru: Forces PowerShell to return the newly generated process object to the pipeline (by default, Start-Process outputs nothing).

./start-process-demo.ps1

Launched Notepad with Process ID: 12044

Stopping Processes with Stop-Process

The Stop-Process cmdlet terminates one or more running processes, identified either by name or PID.

Stop-Process -Name "notepad"
Stop-Process -Id 4032

where:

• -Name stops all processes matching the given name.
• -Id stops a single process matching the given PID.

If a process refuses to close normally, use -Force:

Stop-Process -Name "chrome" -Force

Safe Termination Example

Stop-Process -Id 12044 -Force -Confirm:$false

where:

• Stop-Process: Terminates the target process or set of processes.
• -Id: Targets the specific process by its unique numeric PID.
• -Force: Terminates the process immediately without waiting for confirmation or standard OS shutdown handshakes.
• -Confirm:$false: Overrides interactive prompts to allow automated execution.

./stop-process-demo.ps1

Filtering Processes with Where-Object

Combine Get-Process with Where-Object to filter results based on resource usage, such as CPU time or memory consumption.

Get-Process | Where-Object { $_.WS -gt 200MB }

where:

• $_ represents the current object in the pipeline (each process, one at a time).
• .WS is the process's Working Set memory usage, in bytes.
• 200MB is a PowerShell size literal automatically converted to bytes.

./filter-high-memory.ps1

Handles  NPM(K)    PM(K)      WS(K)     CPU(s)     Id  SI ProcessName
-------  ------    -----      -----     ------     --  -- -----------
    542      24    18432     215400       1.23   4032   1 chrome

You can filter on CPU time the same way, and combine it with Sort-Object to rank results:

Get-Process | Where-Object { $_.CPU -gt 5 } | Sort-Object CPU -Descending

Advanced Filtering and Custom Properties

Get-Process | Where-Object { $_.WorkingSet64 -gt 200MB } | 
    Select-Object -Property Id, ProcessName, @{Name="RAM(MB)"; Expression={[math]::Round($_.WorkingSet64 / 1MB, 2)}}, CPU |
    Sort-Object -Property "RAM(MB)" -Descending

where:

• Get-Process: Streams all active process objects into the pipeline.
• Where-Object: Evaluates each object against a script block filter.
• $_: Automatic variable representing the current object in the pipeline.
• WorkingSet64: The raw integer property measuring physical memory allocation in bytes.
• 200MB: PowerShell numeric multiplier (converts automatically to 209715200 bytes).
• Select-Object: Chooses specified properties and computes a custom calculated property for formatted RAM display.
• Sort-Object: Orders the filtered objects by memory usage from highest to lowest.

./filter-processes.ps1

   Id ProcessName      RAM(MB)    CPU
   -- -----------      -------    ---
 5420 chrome            452.18 128.42
 8112 msedge            312.80  45.19
 9820 pwsh              245.54   4.88

Practical Usage: Stopping High-Memory Processes

A common admin task is identifying and terminating processes that consume excessive memory.

$threshold = 500MB

Get-Process | Where-Object { $_.WS -gt $threshold } | ForEach-Object {
    Write-Output "Stopping $($_.ProcessName) (PID: $($_.Id)) - Using $([math]::Round($_.WS/1MB,2)) MB"
    Stop-Process -Id $_.Id -Force
}

where:

• $threshold is the memory limit (in bytes) used for filtering.
• ForEach-Object iterates over each process that exceeds the threshold.
• [math]::Round() rounds the memory value to 2 decimal places for cleaner output.

./stop-high-memory-processes.ps1

Stopping chrome (PID: 4032) - Using 512.34 MB

Practical Usage: Terminating Unresponsive Applications

In administration workflows, runaway processes must be safely identified and purged without manual task manager intervention. You can test your remediation commands using the -WhatIf common parameter before performing real actions.

Get-Process -Name "notepad" -ErrorAction SilentlyContinue | 
    Where-Object { -not $_.Responding } | 
    Stop-Process -WhatIf

where:

• -ErrorAction SilentlyContinue: Suppresses non-terminating errors if no processes named notepad are currently active.
• $_.Responding: Boolean property of System.Diagnostics.Process returning $true if the UI thread is processing Windows messages, and $false if frozen.
• -WhatIf: Displays what action would occur without actually stopping the process.

./clean-runaway-app.ps1

What if: Performing the operation "Stop-Process" on target "notepad (12044)".

For more on filtering pipeline objects, see Where-Object and ForEach-Object.