Finding Process Owner

PowerShell Version 3 or better

Get-Process gets you a list of all running processes, but it will not reveal the process owner. To find the process owner, you would need to ask the WMI service, for example.

To make this easier, here is a little helper function:

filter Get-ProcessOwner
{
  $id = $_.ID
  $info = (Get-WmiObject -Class Win32_Process -Filter "Handle=$id").GetOwner()
  if ($info.ReturnValue -eq 2)
  {
    $owner = '[Access Denied]'
  }
  else
  {
    $owner = '{0}\{1}' -f $info.Domain, $info.User
  }
  $_ | Add-Member -MemberType NoteProperty -Name Owner -Value $owner -PassThru
}

When you pipe process objects into Get-ProcessOwner, it appends a new property called “Owner” to the process object. This property is hidden unless you ask Select-Object to show it:

 
PS> Get-Process -Id $pid | Get-ProcessOwner | Select-Object -Property Name, ID, Owner

Name                    Id Owner                    
----                    -- -----                    
powershell_ise       10080 TOBI2\Tobias 
 

This works for multiple process objects as well:

 
PS> Get-Process | Where-Object MainWindowTitle | Get-ProcessOwner | Select-Object -Property Name, ID, Owner

Name                    Id Owner                    
----                    -- -----                    
chrome               13028 TOBI2\Tobias             
devenv               13724 TOBI2\Tobias             
Energy Manager        6120 TOBI2\Tobias             
ILSpy                14928 TOBI2\Tobias             
(...)
 

Note that you get process owners only when you have Administrator privileges. Without these privileges, you can get the owner only for your own processes, which is relatively pointless.

ReTweet this Tip!