get the owner of a process

11-06-2007

hi there
i would like to get the name of te "owner " of a process i found with
get-wmiprobject win32_process :
actually, i need to know the "non-system processes" running on a remote
computer;

could you help me please ?
thx
Nico

11-06-2007

This should do the trick

$regex = "LocalSystem|LocalService|NT AUTHORITY|NetworkService|ASPNET";
$svc = gwmi -query "select name,startname,SystemName from win32_service"
| where {$_.startname -notmatch $regex} | select SystemName,name,startname

-----
Shay Levi
$cript Fanatic
http://scriptolog.blogspot.com

	Quote:
	> hi there > i would like to get the name of te "owner " of a process i found with > get-wmiprobject win32_process : > actually, i need to know the "non-system processes" running on a > remote > computer; > could you help me please ? > thx > Nico

11-07-2007

On 6 nov, 20:31, Shay Levi <n...@xxxxxx> wrote:

Quote:

> This should do the trick
>
> $regex = "LocalSystem|LocalService|NT AUTHORITY|NetworkService|ASPNET";
> $svc = gwmi -query "select name,startname,SystemName from win32_service"
> | where {$_.startname -notmatch $regex} | select SystemName,name,startname
>
> -----
> Shay Levi
> $cript Fanatichttp://scriptolog.blogspot.com
>
>
>

	Quote:
	> > hi there > > i would like to get the name of te "owner " of a process i found with > > get-wmiprobject win32_process : > > actually, i need to know the "non-system processes" running on a > > remote > > computer; > > could you help me please ? > > thx > > Nico- Masquer le texte des messages précédents -

>
> - Afficher le texte des messages précédents -

the problem is that i'd like to checks onto the processes, not the
services, but the startname property seems not to exist for this type
of objects

another idea ?
Nico

11-07-2007

In message <1194419045.334726.243640@xxxxxx>,
Nicopilami <n.chaussard@xxxxxx> writes

	Quote:
	>the problem is that i'd like to checks onto the processes, not the >services, but the startname property seems not to exist for this type >of objects

Then use WMI?
--
Thomas Lee
doctordns@xxxxxx
MVP - Admin Frameworks and Security

11-07-2007

This will select all processes name and owner.

$p = gwmi win32_process
$p | select name,@{n="Owner";e={$_.GetOwner().Domain}}

-----
Shay Levi
$cript Fanatic
http://scriptolog.blogspot.com

Quote:

> On 6 nov, 20:31, Shay Levi <n...@xxxxxx> wrote:
>

Quote:

>> This should do the trick
>>
>> $regex = "LocalSystem|LocalService|NT
>> AUTHORITY|NetworkService|ASPNET"; $svc = gwmi -query "select
>> name,startname,SystemName from win32_service" | where {$_.startname
>> -notmatch $regex} | select SystemName,name,startname
>>
>> -----
>> Shay Levi
>> $cript Fanatichttp://scriptolog.blogspot.com

	Quote:
	>>> hi there >>> i would like to get the name of te "owner " of a process i found >>> with >>> get-wmiprobject win32_process : >>> actually, i need to know the "non-system processes" running on a >>> remote >>> computer; >>> could you help me please ? >>> thx >>> Nico- Masquer le texte des messages pr?c?dents -

>> - Afficher le texte des messages pr?c?dents -
>>

> the problem is that i'd like to checks onto the processes, not the
> services, but the startname property seems not to exist for this type
> of objects
>
> another idea ?
> Nico

11-08-2007

"Shay Levi" <no@xxxxxx> a écrit dans le message de news:
8766a944ce6e8c9efa5034a12b6@xxxxxx...

Quote:

> This will select all processes name and owner.
> $p = gwmi win32_process
> $p | select name,@{n="Owner";e={$_.GetOwner().Domain}}
>
>
> -----
> Shay Levi
> $cript Fanatic
> http://scriptolog.blogspot.com
>
>
>

Quote:

>> On 6 nov, 20:31, Shay Levi <n...@xxxxxx> wrote:
>>

	Quote:
	>>> This should do the trick >>> >>> $regex = "LocalSystem\|LocalService\|NT >>> AUTHORITY\|NetworkService\|ASPNET"; $svc = gwmi -query "select >>> name,startname,SystemName from win32_service" \| where {$_.startname >>> -notmatch $regex} \| select SystemName,name,startname >>> >>> ----- >>> Shay Levi >>> $cript Fanatichttp://scriptolog.blogspot.com >>>> hi there >>>> i would like to get the name of te "owner " of a process i found >>>> with >>>> get-wmiprobject win32_process : >>>> actually, i need to know the "non-system processes" running on a >>>> remote >>>> computer; >>>> could you help me please ? >>>> thx >>>> Nico- Masquer le texte des messages pr?c?dents - >>> - Afficher le texte des messages pr?c?dents - >>>

>> the problem is that i'd like to checks onto the processes, not the
>> services, but the startname property seems not to exist for this type
>> of objects
>>
>> another idea ?
>> Nico

>
>

hey, exactly what i was looking for !!
thx
Nico

11-06-2007	#1 (permalink)
Guest n/a posts	get the owner of a process hi there i would like to get the name of te "owner " of a process i found with get-wmiprobject win32_process : actually, i need to know the "non-system processes" running on a remote computer; could you help me please ? thx Nico
My System Specs

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Change all references held by previous owner/administrator to new owner	gerevent	System Security	4	08-17-2008 07:05 PM
Process count wrong when only one process matches criteria	malverson26	PowerShell	3	10-06-2007 03:01 AM
owner names everywhere	puzzled	Vista account administration	3	06-25-2007 12:36 PM
get-process & stop-process by owner	Andrew Conrad	PowerShell	3	03-03-2007 04:11 PM
Bug? Shouldn't Stop-Process automatically match Id if object is a process?	Alex K. Angelopoulos [MVP]	PowerShell	3	06-21-2006 05:35 AM