Tip: You can find the owner of a process:
|
1 2 3 4 5 6 7 8 |
# Parameter -IncludeUserName (Powershell v4/v5 - Run as administrator) Get-Process -Id 5448 -IncludeUserName | Select-Object -Property UserName # CIM Invoke-CimMethod -InputObject $(Get-CimInstance Win32_Process -Filter "ProcessID = '5448'") -MethodName GetOwner # WMI (Powershell v3) (Get-WmiObject -Query 'Select * FROM Win32_Process WHERE ProcessID = 5448').GetOwner() | Select-Object -Property Domain, User |
