Get-Process and Process Owner

Question

I'm trying to sort a script that will retrieve all instances of a process and the respective owners of the process.

I have a script to get the process name and start time:

get-process -name notepad | select-object starttime,name

I have a script to get the process owner:

$process = (Get-CimInstance Win32_Process -Filter "name = 'notepad.exe'")
$owner = Invoke-CimMethod -InputObject $process -MethodName GetOwner | select user | ft -HideTableHeaders

However, when I create a property and put it all together, I get a result which I'm almost certain relates to formatting:

$process = (Get-CimInstance Win32_Process -Filter "name = 'notepad.exe'")
$owner = Invoke-CimMethod -InputObject $process -MethodName GetOwner | select user | ft -HideTableHeaders

get-process -name notepad | select-object starttime,name,@{n='Owner';e={$owner}}

Result:

StartTime                                                               Name                                                                   Owner                                                                 
---------                                                               ----                                                                   -----                                                                 
31/01/2017 14:44:57                                                     notepad                                                                {Microsoft.PowerShell.Commands.Internal.Format.FormatStartData, Mic...

From reading around, it appears to be with the formatting of $owner, but I can't for the life of me figure it out. Any ideas?

score 7 · Accepted Answer · answered Jan 31 '17 at 15:10

Format-Table turns your object into formatted strings, which is great for displaying and for outputting to text files, will mess up any objects that you want to pass. So be careful with any of the format commands. Also since you might want to expand the users property.

$process = (Get-CimInstance Win32_Process -Filter "name = 'notepad.exe'")
$owner = Invoke-CimMethod -InputObject $process -MethodName GetOwner | select -ExpandProperty user
get-process -name notepad | select-object starttime,name,@{n='Owner';e={$owner}}

score 1 · Answer 2 · edited Aug 24 '17 at 20:53

1

Try this out:

tasklist /v /fi "imagename eq notepad.exe" /fo csv | convertfrom-csv | ogv

edited Aug 24 '17 at 20:53

Tim Ferrell

1,348
3
17
40

answered Aug 24 '17 at 16:55

Alejandro Bermúdez

56
1
3

1

While this code snippet may solve the problem, it doesn't explain why or how it answers the question. Please [include an explanation for your code](//meta.stackexchange.com/q/114762/269535), as that really helps to improve the quality of your post. Remember that you are answering the question for readers in the future, and those people might not know the reasons for your code suggestion. **Flaggers / reviewers:** [For code-only answers such as this one, downvote, don't delete!](//meta.stackoverflow.com/a/260413/2747593) – Patrick Aug 24 '17 at 17:14

score 0 · Answer 3 · answered Nov 04 '22 at 02:03

0

Another way:

$owners = @{} 
gwmi win32_process |% {try {$owners[$_.handle] = $_.getowner().user} catch{} } 
(get-process | select processname,Id,@{l="Owner";e={$owners[$_.id.tostring()]}})

answered Nov 04 '22 at 02:03

KERR

1,312
18
13

Get-Process and Process Owner

3 Answers3

Linked