This tutorial discusses a few PowerShell scripts that allow you to query and kill a process on a remote computer using WMI (Windows Management Instrumentation).

Querying processes running on local and remote computers is one of the most common jobs of system administrators. We sometimes need to know which user is running some XYZ application. If you know the process name of the application, then you can quickly scan all your network computers to see how many hosts are running that particular process, and for how long, so that you can prepare an application usage report.

Query process information ^

Let's first see how we can check if a process is running or not. For example, the following command checks if Notepad is running and, if so, displays information about the process:

Get-Process -Name notepad.exe

You will get information about the process, if it is running. You can use the -ComputerName parameter with the command to check if the process is running on a given remote computer. For example:

Get-Process -ComputerName PC1 -Name notepad.exe

You can get similar information with other scripting languages like VBScript and Perl. So what is so special about PowerShell? The answer is that it helps you to get granular information about processes you are querying, such as process creation time, the owner of a given process (with which account it is started), command line information about the process, the title of the application, and much more.

Below are a few example code snippets.

Process creation time ^

Get-ProcessCreationTime.ps1

[cmdletbinding()]
param(
	$ComputerName=$env:COMPUTERNAME,
	[parameter(Mandatory=$true)]
	$ProcessName
)
$Processes = Get-WmiObject -Class Win32_Process -ComputerName $ComputerName -Filter "name='$ProcessName'"
if($Processes) {
	foreach ($process in $processes) {
	$processid = $process.handle
	$processcreationtime = $Process.Converttodatetime($Process.creationdate)
	write-host "`nThe $ProcessName `($processid`) process creation time is $processcreationtime"
}
} else {
	write-host "`nNo Process found with name $ProcessName"
}
write-host ""

The above script takes computer name and process name as arguments. The computer name is optional and defaults to the local computer if not provided. The process name is mandatory, and the script will throw an error if you don’t provide it. After reading the arguments, a WMI query gets the list of processes using the names in the argument and iterates through each process to get its creation date.

Process creation time

Process creation time

Process owner ^

Get-ProcessOwner.ps1

[cmdletbinding()]
param(
  $ComputerName=$env:COMPUTERNAME,
  [parameter(Mandatory=$true)]
  $ProcessName
)
$Processes = Get-WmiObject -Class Win32_Process -ComputerName $ComputerName -Filter "name='$ProcessName'"

foreach ($process in $processes) {
  $UserName = $process.getowner().user
  $DomainName = $process.getowner().domain
  $processid = $process.handle

  write-host "The owner of $ProcessName `($processid`) process is $domainname`\$username"
}

This script executes in the same way as the Process creation time script.

Process owner

Process owner

Process path ^

Get-Processpath.ps1

[cmdletbinding()]
param(
  $ComputerName=$env:COMPUTERNAME,
  [parameter(Mandatory=$true)]
  $ProcessName
)
$Processes = Get-WmiObject -Class Win32_Process -ComputerName $ComputerName -Filter "name='$ProcessName'"

foreach ($process in $processes) {
  $Executablepath = $process.ExecutablePath
  $Commandline = $process.Commandline
  $processid = $process.handle

  Write-Host ""
  Write-Host "Process Name = $ProcessName"
  Write-Host "Process ID = $Processid"
  Write-Host "Executable Path = $Executablepath"
  Write-Host "Command Line = $Commandline"
  Write-Host ""
}

This Powershell script displays the process path.

Process path

Process path

Though PowerShell has a built-in cmdlet (Get-Process) to retrieve process information, in all of the above examples I have used a WMI query to get process information from the Win32_Process class. The reason I did so is because Get-Process will not provide the owner, process path, and other values.

Kill a process ^

To terminate a process using PowerShell, you can either use the WMI interface or use the Stop-Process cmdlet, which comes by default with PowerShell.

Kill-ProcessusingWMI.ps1

[cmdletbinding()]
param(
  $ComputerName=$env:COMPUTERNAME,
  [parameter(Mandatory=$true)]
  $ProcessName
)
$Processes = Get-WmiObject -Class Win32_Process -ComputerName $ComputerName -Filter "name='$ProcessName'"

foreach ($process in $processes) {
  $returnval = $process.terminate()
  $processid = $process.handle

if($returnval.returnvalue -eq 0) {
  write-host "The process $ProcessName `($processid`) terminated successfully"
}
else {
  write-host "The process $ProcessName `($processid`) termination has some problems"
}
}

Kill process

Kill a process

This script first queries the computer for a list of running processes and then terminates them using the terminate () method. This method will return a value of 0 if the termination is successful. Any non-zero value indicates some issues.

The second method terminates a process using the Stop-Process cmdlet. Below are some usage examples:

Get-Process -Name notepad | stop-Process
Stop-Process -Name notepad

Conclusion ^

Querying process information using PowerShell is pretty easy. You can use PowerShell for a variety of purposes, such as reporting application usage, querying the age or the start time of a process, or maximizing, minimizing, or restoring an application window.

+1
18 Comments
  1. Anon 9 years ago

    Thanks for the script!!!!!

    +1

  2. Ken Marvin 8 years ago

    Can these same scripts be used to list and kill a process on a remote server, I am trying to update an applicaiton and someone on the remote server where I am trying to copy the updated files to have the application open, so I would like to close all connection to the application running on the remote server so my script can successfully copy the updated files to that location.

    +9

  3. Limaty 7 years ago

    Thanks for the script......i just want to know, how does one display details like Username, IPAddress, application type, Application name, server name,Host server name and Logon/Logoff time using PowerShell.
    i tried the below code but it dose'nt display the application name.

    import-module remotedesktop

    get-rdusersession -collectionname "quicksessioncollection" | select servername,sessionid,username,domainname,serveripaddress,applicationtype,application name, createtime,sessionstate,collectionname,hostserver

    +1

  4. Raji 5 years ago

    Hi Sitaram,

    I am trying to check the bit status (32 or 64) of a process on a remote machine. I tried the following on the machine and it works but when I try it from a remote machine it does not work. Any suggestions as to what I am doing wrong?

    Get-Process -ComputerName MachR jusched | where { ($_.Modules | where { $_.FileName -match "\\wow64.dll$" }) }

    Thanks for any help you can provide.

    +1

  5. raj 5 years ago

    Just saw your post

    You have posted same script for  Get-ProcessCreationTime.ps1 used for Kill-ProcessusingWMI.ps1

    0

  6. Chris 5 years ago

    Sorry, but the Stop-Process is not working on a remote-target. i would have to go remotely to the machine frist to use there the Stop-Process commandlet.

    0

    • For killing the process on the remote computer you could make use of the taskkill utility or use wmic as:

      wmic /node:remotemachine process where name="notepad.exe" call terminate
      +1

  7. Uma 4 years ago

    This helped me today..thanks for sharing

    0

  8. nithin 2 years ago

    Hi, How to kill multiple process at a time using the above script. 

    +1
    avatar
    • Please use multiple filters to select multiple processes to be deleted. For e.g.

      Get-WmiObject -Class Win32_Process -Filter "Name Like 'notepad%' OR name like 'dockerd%'"

       

      +1

  9. nithin 2 years ago

    Hi Swapnil, Thanks for the reply. But I have total 9 processes to be killed. So, what will be the approach for this.

    +1
    avatar
    • Hi Nithin,

      You could construct a command similar to below command:

      wmic /node:@"c:\ServerList.txt" process where "name Like '%notepad%' or name Like '%wordpad%'" call terminate
      0

  10. AD 2 years ago

    I am trying to kill all RDP sessions in the terminal server, how can I add a confirmation prompt instead of killing it without any prompt. Thanks

    0

  11. AD - I'm not sure what you are asking, but you can easily kill/logoff sessions remotely using some regular exe's that are included by default in most modern versions of Windows.

    qwinsta /server:<servername>
    #This gets you the Winstations with session ID's
    quser /server:<servername>
    #this gets you the user session states, including idle time etc.. 
    #then use:
    logoff /id:<sessionid number> /server:<servername>

    David F.

    0

  12. George 2 years ago

    How can I stop a particular PID on a remote machine 

    0

  13. Assuming you have admin rights, you can do a 

    tskill <pid> /server:<servername>

    David F.

    0

  14. Roxette Rose 7 months ago

    Hi Sitaram, thank you for the article

    I'm actually looking for combining your suggestions on how to Get Process for purposes of identifying any application that's in a 'not responding' state (the message that appears in Windows when effectively a program has hung/stalled.

     

    And then I want it to be force closed/task killed.
    My hope was then to set an automated task in Windows to run the script periodically

     

    I am having a little difficulty putting it altogether
    Any chance you could drum up something basic or explain how to turn your Get Process /monitoring into an automated kill script?

    Thank you
    Roxy

    0

Leave a reply

Please enclose code in pre tags

Your email address will not be published. Required fields are marked *

*

© 4sysops 2006 - 2021

CONTACT US

Please ask IT administration questions in the forums. Any other messages are welcome.

Sending

Log in with your credentials

or    

Forgot your details?

Create Account