如何在PowerShell或C＃中获取进程的命令行信息

e.g: if I run notepad.exe c:\autoexec.bat,

例如：如果我运行notepad.exe c：\ autoexec.bat，

How can I get c:\autoexec.bat in Get-Process notepad in PowerShell?

如何在PowerShell中的Get-Process记事本中获取c：\ autoexec.bat？

Or how can I get c:\autoexec.bat in Process.GetProcessesByName("notepad"); in C#?

或者如何在Process.GetProcessesByName（“notepad”）中获得c：\ autoexec.bat;在C＃？

2 个解决方案

#1

In PowerShell you can get the command line of a process via WMI:

在PowerShell中，您可以通过WMI获取进程的命令行：

$process = "notepad.exe"
Get-WmiObject Win32_Process -Filter "name = '$process'" | Select-Object CommandLine

Note that you need admin privileges to be able to access that information about processes running in the context of another user. As a normal user it's only visible to you for processes running in your own context.

请注意，您需要管理员权限才能访问有关在其他用户的上下文中运行的进程的信息。作为普通用户，只有在您自己的上下文中运行的进程才能看到它。

#2

This answer is excellent, however for futureproofing and to do future you a favor, Unless you're using pretty old powershell (in which case I recommend an update!) Get-WMIObject has been superseded by Get-CimInstance Hey Scripting Guy reference

这个答案非常好，但是对于未来的防护和未来的帮助，除非你使用相当旧的powershell（在这种情况下我建议更新！）Get-WMIObject已被Get-CimInstance Hey Scripting Guy引用取代

Try this

尝试这个

$process = "notepad.exe"
Get-CimInstance Win32_Process -Filter "name = '$process'" | select CommandLine

#1