How to Use Windows PowerShell ‘Get-Process’ for Advanced Resource Monitoring

Moving Beyond the Task Manager

When a Windows computer slows to a crawl, the standard response is to press Ctrl+Shift+Esc to open the Task Manager, click the “Memory” or “CPU” column, and manually identify which application is hogging resources.

While the Task Manager is great for closing a frozen web browser, it is entirely useless for IT administrators. You cannot script the Task Manager. You cannot tell it to run automatically at 3:00 AM, log the top five CPU-heavy processes to a text file, and email that log to the IT department.

For scriptable, programmatic resource monitoring in Windows, you must use the PowerShell cmdlet: Get-Process. This command pulls live, object-oriented data directly from the Windows kernel.

1. Basic Process Retrieval

To see a list of every single process currently running on the system, open PowerShell and type:

Get-Process

This returns a massive table showing the Process Name, the Process ID (Id), and memory usage metrics (like NPM, PM, WS, and VM).

2. Filtering and Sorting for Diagnostics

Dumping 300 processes to the screen is useless. The power of PowerShell is its ability to filter and sort this object data instantly.

Finding the Top Memory Hogs

To find out exactly which application is using the most physical RAM (Working Set, or WS), we pipe the output into the Sort-Object cmdlet, and then use Select-Object to only show the top 5 worst offenders.

Get-Process | Sort-Object WS -Descending | Select-Object -First 5

Finding the Top CPU Hogs

Similarly, to see which processes have consumed the most total CPU time since they were launched:

Get-Process | Sort-Object CPU -Descending | Select-Object -First 5

3. Detailed Auditing of a Specific App

If you know that Google Chrome is causing problems, you don’t need to list everything. You can isolate a specific application by its name.

Get-Process -Name chrome

Chrome usually runs dozens of individual processes simultaneously (one for every tab and extension). If you want to calculate the total memory being used by all Chrome processes combined, you can pipe the results into the Measure-Object cmdlet:

Get-Process -Name chrome | Measure-Object -Property WS -Sum

This outputs the exact, total sum of memory consumed by the entire browser architecture.

4. Monitoring Uptime and File Paths

By default, Get-Process only shows a few columns of data. Because PowerShell is object-oriented, it actually retrieves dozens of hidden data points for every process.

To see exactly what time a suspicious application started running, and the exact folder path of the .exe file it launched from, you can ask PowerShell to expose those hidden properties.

Get-Process | Select-Object Name, StartTime, Path

(Note: You must run PowerShell as Administrator to read the start times and paths of processes owned by other users or the SYSTEM).

5. Killing Rogue Processes Programmatically

Once you identify a process that is locked up or consuming 100% of the CPU, you can pipe it directly into the Stop-Process cmdlet to kill it instantly, bypassing the need to right-click in Task Manager.

Get-Process -Name notepad | Stop-Process -Force

This immediately terminates every instance of Notepad running on the system.

Conclusion

The Get-Process cmdlet transforms process management from a reactive, manual chore into a proactive, scriptable workflow. By mastering these commands, administrators can build automated monitoring scripts that log performance bottlenecks in real-time, long before a user complains that their system is running slowly.