Finding a process owner using PowerShell

The get-process cmdlet can be used to view processes. It works remotely too via the -ComputerName switch and for Unix aficionados there’s a handy ps alias. So it’s very easy to do something like the below to list all “explorer.exe” process on a remote computer “mango”.

The problem arises when you want to find the owner of such processes. Oddly enough the process objects returned by get-process don’t have a property or method to find the owner info so we have to resort to WMI to find that. Specifically, the WMI class Process.

Reformulating the above example in terms of WMI, we have the following:

The output returned via WMI looks different compared to the output returned via get-process. If you pipe this output through the get-member cmdlet you’ll see there’s a method that lets you get the process owner.

The GetOwner method is what we are interested in. Invoke it thus:

The method returns a list of properties, of which the User property is what we are after. So here’s how we extract just that in a one-liner.