How to retrieve command line in some process in PowerShell

Question

Using the following code I can get the CommandLine of a process by passing the PID:

Get-CimInstance -ClassName Win32_Process -Filter "ProcessId = '11132'" | Select Name,ProcessId,CommandLine

Get-CimInstance -ClassName Win32_Process -Filter "ProcessId = '8260'" | Select Name,ProcessId,CommandLine

Get-CimInstance -ClassName Win32_Process -Filter "ProcessId = '9308'" | Select Name,ProcessId,CommandLine

BUT the same command is not returning the CommandLine in some of the processes as shown here:

Get-CimInstance -ClassName Win32_Process -Filter "ProcessId = '4208'" | Select Name,ProcessId,CommandLine

Get-CimInstance -ClassName Win32_Process -Filter "ProcessId = '3944'" | Select Name,ProcessId,CommandLine

How can I fix this?

Answer 1

• If there's a permissions-related inability to retrieve certain processes' command lines, Get-CimInstance Win32_Process quietly ignores the failure, resulting in the .CommandLine property containing $null.

  • In PowerShell (Core) 7+, the same applies to the .CommandLine property of the objects output by Get-Process (this property isn't available in Windows PowerShell).

• Therefore, to be able to query as many process command lines as possible, run your Get-CimInstance call from an elevated (run-as-admin) session.

  • However, even then a select few - presumably system-owned - processes can not be queried, neither in terms of their command line nor in terms of their user (the identity of the user account owning the process), which Get-Process allows you to request via its -IncludeUserName switch.

  • To find those processes, run the following from an elevated session:

    Get-CimInstance Win32_Process | Where-Object { -not $_.CommandLine }
    

---

Since the two service processes shown in your questions aren't system services, I would expect the following to work when run with elevation:

#requires -RunAsAdministrator

Get-CimInstance Win32_Process -Filter 'Name = "TeamViewer_Service.exe" OR Name = "ErgonomicKBNotificationService.exe"' | 
  Select-Object ProcessId, Name, CommandLine