Inspecting Running Processes
Get-Process returns every running process as an object with properties like Id, ProcessName, CPU, and WorkingSet, so you can pipe it into Sort-Object CPU -Descending to find the heaviest consumers or Where-Object { $_.WorkingSet -gt 500MB } to isolate memory-hungry processes. Get-Process -Name notepad or Get-Process -Id 1234 lets you target a specific process by name or process ID, and the returned object exposes a Modules collection and a StartTime property useful for diagnostics.
Cricket analogy: Sorting Get-Process by CPU -Descending is like ranking a tournament's batsmen by strike rate, immediately surfacing whoever is consuming the most 'resources' (deliveries faced) fastest.
Starting and Stopping Processes
Start-Process launches an executable and supports -ArgumentList for command-line arguments, -WindowStyle to control visibility, -Verb RunAs to elevate with UAC, and -Wait to block the script until the launched process exits. Stop-Process -Id or -Name terminates a running process, and -Force is required to kill a process that would otherwise prompt for confirmation or resist termination, though forcibly killing a process skips its normal cleanup and can leave file handles or temp files behind.
Cricket analogy: Start-Process -Wait is like a captain waiting for the current over to finish before making a bowling change, blocking further action until the process (over) completes.
Managing Windows Services
Get-Service lists Windows services with a Status property of Running, Stopped, or others, and Start-Service, Stop-Service, and Restart-Service control a service's running state by name, such as Restart-Service -Name Spooler. Set-Service -StartupType controls whether a service starts Automatic, Manual, or Disabled at boot, and because many services depend on others, Stop-Service will fail on a service with running dependents unless you add -Force, which stops dependent services too.
Cricket analogy: Set-Service -StartupType Automatic is like a franchise permanently including a player in the starting XI for every match, versus Manual, which is like calling them up only when specifically needed.
# Find the top 5 CPU-consuming processes
Get-Process | Sort-Object CPU -Descending | Select-Object -First 5 Name, Id, CPU, WorkingSet
# Restart a service and confirm it's running, forcing dependents to restart too
Stop-Service -Name Spooler -Force
Start-Service -Name Spooler
Get-Service -Name Spooler | Select-Object Name, Status, StartType
# Launch an elevated process and wait for it to finish
Start-Process -FilePath 'diskpart.exe' -Verb RunAs -WaitGet-CimInstance -ClassName Win32_Process exposes information Get-Process does not, such as the parent process ID (ParentProcessId) and the full command line used to start a process, which is invaluable when auditing what launched a suspicious process.
- Get-Process returns process objects with properties like Id, CPU, and WorkingSet that can be sorted and filtered.
- Start-Process supports -ArgumentList, -Verb RunAs for elevation, and -Wait to block until the process exits.
- Stop-Process -Force terminates a process immediately, skipping normal cleanup.
- Get-Service lists services with a Status of Running, Stopped, and others.
- Start-Service, Stop-Service, and Restart-Service control a service's runtime state by name.
- Set-Service -StartupType controls whether a service starts Automatic, Manual, or Disabled.
- Stop-Service -Force is required to stop a service that has running dependent services.
Practice what you learned
1. Which parameter of Start-Process launches a program with administrator elevation via UAC?
2. What does Stop-Process -Force do differently from a plain Stop-Process?
3. Which cmdlet configures whether a Windows service starts automatically at boot?
4. Why would Stop-Service fail without the -Force parameter?
5. What extra information does Get-CimInstance -ClassName Win32_Process provide that Get-Process does not?
Was this page helpful?
You May Also Like
Working with Files and Folders
Learn how PowerShell treats the file system as a navigable provider, and how to create, read, write, copy, move, and delete files and folders with dedicated cmdlets.
Scheduled Tasks and Jobs
Learn the difference between PowerShell background jobs and Windows Scheduled Tasks, and how to create, monitor, and manage both from the command line.
Remoting with PowerShell
Learn how PowerShell Remoting uses WinRM to run commands on remote machines, including interactive sessions, one-off invocations, and persistent connections.
Related Reading
Related Study Notes in Programming
Browse all study notesApache Spark Study Notes
Programming · 30 topics
ProgrammingApache Flink Study Notes
Programming · 30 topics
ProgrammingHadoop Study Notes
Programming · 30 topics
ProgrammingSnowflake Study Notes
Programming · 30 topics
ProgrammingApache Airflow Study Notes
Programming · 30 topics
Programmingdbt (Data Build Tool) Study Notes
Programming · 30 topics