e.g: if I run notepad.exe c:\autoexec.bat
,
How can I get c:\autoexec.bat
in Get-Process notepad
in PowerShell?
Or how can I get c:\autoexec.bat
in Process.GetProcessesByName("notepad");
in C#?
e.g: if I run notepad.exe c:\autoexec.bat
,
How can I get c:\autoexec.bat
in Get-Process notepad
in PowerShell?
Or how can I get c:\autoexec.bat
in Process.GetProcessesByName("notepad");
in C#?
In PowerShell you can get the command line of a process via WMI:
$process = "notepad.exe" Get-WmiObject Win32_Process -Filter "name = '$process'" | Select-Object CommandLine
Note that you need admin privileges to be able to access that information about processes running in the context of another user. As a normal user it's only visible to you for processes running in your own context.
This answer is excellent, however for futureproofing and to do future you a favor, Unless you're using pretty old powershell (in which case I recommend an update!) Get-WMIObject has been superseded by Get-CimInstance Hey Scripting Guy reference
Try this
$process = "notepad.exe" Get-CimInstance Win32_Process -Filter "name = '$process'" | select CommandLine