Process management (Get/Stop-Process) in PowerShell - Cheat Sheet & Quick Revision

Recall & Review

beginner

What does the <code>Get-Process</code> cmdlet do in PowerShell?

Get-Process shows a list of all running processes on your computer. It helps you see what programs or services are active.

beginner

How do you stop a process by its name using PowerShell?

You use Stop-Process -Name <processName>. For example, Stop-Process -Name notepad stops all Notepad processes.

beginner

What parameter would you use with Get-Process to find a specific process by its ID?

Use -Id parameter. For example, Get-Process -Id 1234 shows the process with ID 1234.

intermediate

What happens if you try to stop a process that requires administrator rights without running PowerShell as admin?

The command will fail with an error because you don’t have permission to stop that process. You need to run PowerShell as administrator.

beginner

How can you stop a process using its process ID in PowerShell?

Use Stop-Process -Id <processId>. For example, Stop-Process -Id 5678 stops the process with ID 5678.

Which cmdlet lists all running processes on your computer?

A Stop-Process

B Get-Process

C Start-Process

D New-Process

Get-Process lists running processes. Stop-Process stops them.

How do you stop a process named 'chrome' using PowerShell?

A Stop-Process -Id chrome

B Get-Process -Name chrome

C Stop-Process -Name chrome

D Kill-Process chrome

Use Stop-Process -Name chrome to stop all Chrome processes.

What parameter lets you specify a process ID with Get-Process?

A -Id

B -PIDName

C -ProcessId

D -Name

The correct parameter is -Id to specify a process ID.

If you don’t run PowerShell as administrator, what happens when you try to stop a system process?

A You get a permission error

B PowerShell crashes

C Process stops successfully

D Process restarts automatically

You get a permission error because stopping system processes requires admin rights.

Which command stops a process with ID 4321?

A Kill-Process -Id 4321

B Stop-Process -Name 4321

C Get-Process -Id 4321

D Stop-Process -Id 4321

Stop-Process -Id 4321 stops the process with that ID.

Explain how to list all running processes and then stop one by its name using PowerShell.

Think about how you first see processes and then stop one by name.

Describe what permissions are needed to stop certain processes and how to handle permission errors in PowerShell.

Consider what happens when you try to stop system processes.

Practice

1. What does the PowerShell command Get-Process do?

easy

A. Lists all running processes on the computer

B. Stops a running process immediately

C. Starts a new process

D. Deletes a file from the system

Solution

1. Step 1: Understand the purpose of Get-Process

   The command Get-Process is used to display information about processes currently running on the computer.

2. Step 2: Compare options with command function

   Only Lists all running processes on the computer correctly describes listing running processes. Other options describe different actions not related to Get-Process.

3. Final Answer:

   Lists all running processes on the computer -> Option A

4. Quick Check:

   Get-Process lists processes = A [OK]

Hint: Get-Process always shows running programs, not stopping them [OK]

Common Mistakes:

• Confusing Get-Process with Stop-Process
• Thinking Get-Process starts or deletes processes
• Assuming it modifies processes instead of listing

2. Which of the following is the correct syntax to stop a process named 'notepad' in PowerShell?

easy

A. Stop-Process notepad -Force

B. Get-Process -Stop notepad

C. Kill-Process -Name notepad

D. Stop-Process -Name notepad

Solution

1. Step 1: Identify correct cmdlet and parameter

   The cmdlet to stop a process is Stop-Process. The parameter to specify process by name is -Name.

2. Step 2: Validate syntax correctness

   Stop-Process -Name notepad uses correct cmdlet and parameter: Stop-Process -Name notepad. Get-Process -Stop notepad uses wrong cmdlet and parameter. Stop-Process notepad -Force misses the parameter name before 'notepad'. Kill-Process -Name notepad uses a non-existent cmdlet.

3. Final Answer:

   Stop-Process -Name notepad -> Option D

4. Quick Check:

   Stop-Process with -Name is correct syntax = C [OK]

Hint: Use Stop-Process with -Name to stop by process name [OK]

Common Mistakes:

• Omitting the -Name parameter
• Using incorrect cmdlet names like Kill-Process
• Placing process name without parameter name

3. What will be the output of this PowerShell command?

Get-Process -Name powershell | Stop-Process -PassThru

medium

A. Lists all running PowerShell processes without stopping them

B. Stops the PowerShell process and outputs the stopped process details

C. Throws an error because Stop-Process cannot be piped

D. Starts a new PowerShell process

Solution

1. Step 1: Understand the pipeline usage

   The command gets the process named 'powershell' and pipes it to Stop-Process. The -PassThru parameter makes Stop-Process output the stopped process object.

2. Step 2: Predict command behavior

   The process will be stopped, and its details will be shown as output. No error occurs because piping is supported.

3. Final Answer:

   Stops the PowerShell process and outputs the stopped process details -> Option B

4. Quick Check:

   Get-Process piped to Stop-Process with -PassThru stops and outputs = B [OK]

Hint: Stop-Process supports pipeline input and -PassThru outputs stopped process [OK]

Common Mistakes:

• Thinking Stop-Process cannot accept pipeline input
• Assuming it only lists processes without stopping
• Confusing -PassThru as a force stop

4. You run this command but get an error:

Stop-Process -Name

What is the problem and how to fix it?

medium

A. The command should be Get-Process -Name instead

B. Stop-Process does not use -Name; use -Id instead

C. Missing process name after -Name; add the process name

D. Stop-Process requires -Force parameter always

Solution

1. Step 1: Identify the error cause

   The command uses -Name parameter but does not specify the process name, causing a syntax error.

2. Step 2: Correct the command

   To fix, provide the process name after -Name, for example: Stop-Process -Name notepad.

3. Final Answer:

   Missing process name after -Name; add the process name -> Option C

4. Quick Check:

   Parameter -Name needs a value = D [OK]

Hint: Always provide a value after -Name parameter [OK]

Common Mistakes:

• Leaving -Name without a value
• Assuming -Force is always required
• Confusing Stop-Process with Get-Process

5. You want to stop all running instances of 'chrome' safely but only if they use more than 100 MB of memory. Which PowerShell command achieves this?

hard

A. Get-Process -Name chrome | Where-Object { $_.WorkingSet -gt 100000000 } | Stop-Process

B. Get-Process -Name chrome | Where-Object { $_.WorkingSet -gt 100MB } | Stop-Process

C. Stop-Process -Name chrome -MemoryLimit 100MB

D. Get-Process chrome | Stop-Process -MemoryUsage 100MB

Solution

1. Step 1: Understand memory property and filtering

   The WorkingSet property shows memory usage in bytes. 100 MB equals 100,000,000 bytes approximately.

2. Step 2: Filter processes by memory and stop them

   Get-Process -Name chrome | Where-Object { $_.WorkingSet -gt 100000000 } | Stop-Process correctly filters chrome processes with memory usage greater than 100,000,000 bytes and pipes them to Stop-Process. Get-Process -Name chrome | Where-Object { $_.WorkingSet -gt 100MB } | Stop-Process uses '100MB' which is invalid syntax. Options C and D use non-existent parameters.

3. Final Answer:

   Get-Process -Name chrome | Where-Object { $_.WorkingSet -gt 100000000 } | Stop-Process -> Option A

4. Quick Check:

   Memory in bytes filter with Where-Object = A [OK]

Hint: Memory is in bytes; use numeric value, not '100MB' string [OK]

Common Mistakes:

• Using '100MB' as a value instead of bytes
• Trying to use Stop-Process parameters that don't exist
• Not filtering processes before stopping