>> - Hello everyone.
I'm instructor Gerri Roberts,
and this is PowerShell scripting.
In this video we're going to learn about
managing processes using Get-Process.
We're going to learn about Stop-Process
and Start-Process.
Get-Process is a CMD
that allows you to manage
local and remote processes in PowerShell.
If you don't specify a computer name,
it automatically assumes that you're looking at
your local process so
it'll find everything that's on your local machine.
Stop-Process is another command you can use to
manage processes and it allows you to kill a process.
Start-Process is similar only it
allows you to start a stopped process.
Let's actually take a look at what that
will look like when we run it in PowerShell.
In PowerShell,
we can do a couple of different things with processes.
The first one we talked about was Get-Process.
We can do just Get-Process.
It shows us a huge list
and you'd be able to scroll through,
see the different processes.
It'll tell you if it's running,
what kind of CPU memory,
all that good stuff that it's using.
That's obviously a lot.
If you wanted to try to find a process by say ID,
which is this column right here,
you would find the process that you're looking for.
Let's say for example,
we wanted to bring up one of the Firefox's.
We have 2028 as a Firefox process.
We could go back down.
Let's go ahead and clear
our screen so it's a little bit easier to read.
We could [NOISE] do get that process.
Look up by ID.
We have 2028 is our ID.
There. That's much better looking.
You can see there's our process and you
can see the information about the process.
You can also look up a process by name.
You can do Get-Process and then name.
Then you just type in Firefox.
There you go, you've got your list.
This one gives you
a little more results because it's by name.
There's going to be usually more than one of each name,
or you might have quite a few by a similar name.
Say for example, I wasn't sure
exactly what the name of something was,
but I knew for a fact that it started with EX.
So I could do EX and
then we can actually use a wildcard here.
So we do the wildcard asterisk,
Enter and it will pop
up the name of the item in the process.
If there's more than one,
you would get a list just like you did with Firefox.
You can also do multiple values in the name parameter.
You want to do Get-Process dash name.
We just say I'm going to do
exp because I think one of
them starts with the exp and then I'm going to do power.
Remember in an earlier video,
we said if there are multiple values
inside of a parameter you use a comma.
Here you can see I'm going to do a comma
between exp and power to try to
find the processes that
start with exp and some processes that start with power.
I'll look at that. I've got Explorer starts with exp,
and now we have PowerShell that starts with power.
You can do that as well.
That's pretty useful and does help you find things
instead of having to poke around that giant list that you
saw earlier if you do just Get-Process.
Another thing you can do is use
computer name to get
the process of a process on a remote computer.
I'm not connected to a remote computer so if I
tried to get a remote computer, I wouldn't get anything.
But I'm going to show you what that might look like.
You do Get-Process,
and then you do the name or
ID or whatever you wanted
through the process or all of them.
I'm just going to get PowerShell.
Computer name would be
the actual parameter that
you would use to find that computer,
but I'm going to do local host.
But whatever the computer name is,
you can use that like if it's a server or whatnot,
just put that name there and as long
as it's able to communicate with that computer,
you'll be able to pull those processes.
Local host just stands for your local computer.
Notice that when I put it in, I get an error.
That's okay, it happens.
We're going to try with
our actual computer name to see if we can find it.
The computer name,
I'm going to put my computer's name
Gerri-PC2 because I don't have anything I'm connected
to and you can see that it pops it up.
If you were using a remote computer,
you could put another computer name there.
As long as you can connect to that computer,
you can go ahead and pull up
information about that computer.
You could do Get-Process and not put
a name or an ID and have all of the processes,
or you can put a name,
or you can put in an ID.
But the important part is if you're doing remote,
use a computer name parameter to
actually connect to that computer
and get that information.
The next command that you'll want to look
at is the Stop-Process command.
Once you have your list of processes,
if you find that one is using up too many resources,
or if it has,
for some reason locked up,
you can use the Stop-Process command to
essentially kill that particular process.
This is similar to the Kill command
>> in Linux and is also
>> similar to the End Task button
you get in Task Manager in Windows.
The first thing you want to do is you
want to find your process.
We're going to use Notepad as
an example because that's an easy one to find.
We do Get-Process,
name and then Notepad.
You see, there's our process.
When using Stop-Process,
you usually use the name Switch.
What we do is we do [NOISE] Stop-Process
, name, Notepad.
You notice you don't get anything.
A lot of times with PowerShell,
you don't necessarily get a confirmation.
But we can tell that this process
has been completely stopped because we
try and we get the process again.
Red text, it can't find it.
That's because it's not running anymore.
It's gone, it's disappeared.
Once we stop a process,
if we do want to start it again,
or if we have a process that maybe
didn't start properly for
like SQL Server or something like that,
we can restart that process
using the Start-Process command.
The difference with Start-Process versus
Get-Process and Stop-Process is with Start-Process,
you actually need to know
where that particular process is located.
For our purposes here,
Notepad it's pretty easy to find.
It's in the System32 folder.
The reason we need to know where it's located is
the file path string
that we need to put in is actually required,
it's a required parameter.
That allows us to find the particular process.
You do Start-Process and then you could do file path,
and then you tell it where it is.
System32 is going to be C Windows System32.
Our Notepad is Notepad.exe.
Then Notepad will pop up.
Here you go, you got Notepad.
You could go ahead and close it normally.
Stop-Process, easy, Start-Process, not so easy.
You have to find where
that particular item is using file path.
If it's a normal process,
it's usually in that System32 folder.
But if you don't know,
you can search for using
Windows Search and you can
find it and be able to restart it again.
That is your Stop-Process and your Start-Process.
Now that we've gone through our demo for Get-Process,
Start-Process, and Stop-Process,
it's time for a quiz.
Our first assessment question.
What command would you use to find
a process named "winlogin"?
Would you do Get-Process-ID winlogin?
Would you do Get-Process -Name winlogin?
Would you do Get-Process winlogin or would
you do Get-Process-ID 000?
I'll go ahead and give you a second to
>> think about that.
>> You can also pause if you want.
The answer is B. Get-Process -Name winlogin.
Remember, whenever we're using a name,
we use the -Name parameter to locate it.
Today's lecture we talked about getting processes using
the Get-Process command as well
some other commands we can use to work with processes.