header image

Win32_Process examples–test command line

Posted by: | January 20, 2014 | No Comment |

To see the command lines that have been used when processes are started is simple one liner:

Get-CimInstance -ClassName Win32_Process | select Name, CommandLine

If you want to investigate specific processes use the –Filter parameter to restrict the processes

under: PowerShell and CIM, PowerShell V3, PowerShell v4