PowerShell view the owning user of the process _powershell

Applies to all Windows PowerShell versions

To see who the owner of a particular process is, and how many instances of a change process, you can try the following code:

Copy Code code as follows:

$ProcessName = ' Explorer.exe '
(get-wmiobject-query "SELECT * from Win32_Process where name= ' $ProcessName ')". GetOwner (). User

Note: There are a number of different ways to get the currently logged in user, but the method varies depending on your operating system version. If you are fine with a graphical user interface, but if the core server is a non user interface, the script may not detect the user who is currently connected to the host.

The example above returns the owner of all the "explorer.exe" processes. If you have administrator privileges and are logged in remotely, the user list may also include inactive users. Because the Explorer.exe that are open on each desktop may belong to different sessions, different users.

If you use the Sort-object command, you can easily exclude duplicates.

Copy Code code as follows:

$ProcessName = ' Explorer.exe '
(get-wmiobject–query "SELECT * from Win32_Process where name= ' $ProcessName ')". GetOwner (). User |
Sort-object-unique

Also, if you change the name of the process you want to view, you'll find other interesting things. The following script lists the users currently connected to your machine through PowerShell remote management:

Copy Code code as follows:

$ProcessName = ' Wsmprovhost.exe '
Try
{
(get-wmiobject-query "SELECT * from Win32_Process where name= ' $ProcessName ')". GetOwner (). User |
Sort-object-unique
}
Catch
{
Write-warning "no user found."
}