PowerShell Get-Process: Find and Manage Running Processes
─□✕

PowerShell Get-Process: Find and Manage Running Processes

PowerShell Tips Editor 3 min read
PowerShell Get-Process: Find and Manage Running Processes

Your system is sluggish. Task Manager tells you CPU is at 95% but doesn’t give you a programmable, exportable list of offenders. PowerShell Get-Process returns every running process as a structured object with CPU time, memory usage, process ID, and a dozen other properties — giving you instant, scriptable visibility into what’s consuming your system resources. This guide covers filtering, sorting, top-N analysis, stopping processes, and querying remote machines.

Quick Answer / TL;DR

# Top 10 processes by memory
Get-Process | Sort-Object WorkingSet -Descending | Select-Object -First 10 Name, Id,
    @{ Name='MemMB'; Expression={ [math]::Round($_.WorkingSet/1MB,1) } }

List All Running Processes

Call Get-Process with no arguments to see every process on the local machine:

# All processes
Get-Process

# See all available properties
Get-Process | Get-Member -MemberType Property | Select-Object Name, MemberType

# Summary count
(Get-Process).Count
Handles  NPM(K)    PM(K)      WS(K)     CPU(s)     Id  SI ProcessName
-------  ------    -----      -----     ------     --  -- -----------
    412       27    48692      57412      12.38   4892   1 chrome
    178       15    22348      28764       3.21   6124   1 explorer
    312       24    42816      53248     245.12   7234   1 vscode

The CPU(s) column shows total lifetime CPU seconds, not current percentage. For real-time CPU percentage, use Performance Counters (Get-Counter) or CIM instances.

Filter by Process Name

Pass a name directly to -Name or use Where-Object for pattern matching:

# Exact name match (without .exe extension)
Get-Process -Name 'chrome'

# Multiple processes
Get-Process -Name 'chrome', 'msedge', 'firefox'

# Wildcard match
Get-Process -Name 'sql*'

# Is a specific process running?
if (Get-Process -Name 'notepad' -ErrorAction SilentlyContinue) {
    Write-Output 'Notepad is running'
}
Handles  NPM(K)    PM(K)      WS(K)     CPU(s)     Id  SI ProcessName
-------  ------    -----      -----     ------     --  -- -----------
    412       27    48692      57412      12.38   4892   1 chrome

Process names in PowerShell omit the .exe extension. Get-Process chrome works; Get-Process chrome.exe returns nothing.

Sort by CPU or Memory Usage

# Sort by total CPU time (lifetime seconds, not current %)
Get-Process | Sort-Object CPU -Descending | Select-Object -First 10 Name, CPU

# Sort by working set memory
Get-Process | Sort-Object WorkingSet -Descending |
    Select-Object -First 10 Name,
        @{ Name='MemMB'; Expression={ [math]::Round($_.WorkingSet/1MB,1) } }

# Sort by private memory (more accurate for memory consumption)
Get-Process | Sort-Object PrivateMemorySize64 -Descending |
    Select-Object -First 10 Name,
        @{ Name='PrivMB'; Expression={ [math]::Round($_.PrivateMemorySize64/1MB,1) } }
Name       MemMB
----       -----
chrome     523.2
outlook    187.4
vscode     157.3
powershell  84.1
explorer    43.7

Find Top Memory-Consuming Processes

# Build a formatted memory report
Get-Process |
    Sort-Object WorkingSet -Descending |
    Select-Object -First 15 ProcessName, Id,
        @{ Name='MemMB';  Expression={ [math]::Round($_.WorkingSet/1MB,1) } },
        @{ Name='CPU(s)'; Expression={ [math]::Round($_.CPU,1) } },
        @{ Name='Threads'; Expression={ $_.Threads.Count } } |
    Format-Table -AutoSize
ProcessName  Id    MemMB CPU(s) Threads
-----------  --    ----- ------ -------
chrome      4892  523.2   12.4      48
outlook     7123  187.4    3.2      28
vscode      3456  157.3   45.1      36

Stop a Process with Stop-Process

Kill a process by name or by process ID:

# Kill by name — kills all instances
Stop-Process -Name 'notepad'

# Kill by process ID — specific instance
Stop-Process -Id 4892

# Force kill (bypasses "are you sure")
Stop-Process -Name 'chrome' -Force

# Preview with -WhatIf
Stop-Process -Name 'notepad' -WhatIf
What if: Performing the operation "Stop-Process" on target "notepad (12345)".

Get Process Info on Remote Computer

Query processes on a remote machine using the -ComputerName parameter (requires WinRM):

# Get processes on a remote server
Get-Process -ComputerName 'server01'

# Filter on remote machine
Get-Process -ComputerName 'server01', 'server02' -Name 'sqlservr' |
    Select-Object MachineName, Name, CPU, WorkingSet

Common Errors and Fixes

  • Stop-Process requires admin for other users’ processes: Trying to stop a process owned by another user or a system process throws “Access is denied.” Run PowerShell as Administrator to stop system-owned processes.
  • CPU value is lifetime CPU not current % — use PerfCounters for %: The CPU property is total elapsed CPU seconds since process start. For real-time CPU percentage, use: (Get-Counter '\Process(chrome)\% Processor Time').CounterSamples.CookedValue / [Environment]::ProcessorCount.

Related Cmdlets / See Also

Wrapping Up

Get-Process gives you a complete, real-time view of running processes with properties you can filter, sort, and report on. Use WorkingSet for memory comparisons, Get-Counter for real CPU percentages, and -ErrorAction SilentlyContinue when checking whether a specific process is running. Your next step: build a scheduled script that logs the top 10 memory consumers every hour to CSV for trend analysis.

#cpu#get-process#memory#processes
Send-Item -To