Forum Discussion

TrapTheOnly's avatar
TrapTheOnly
Copper Contributor
Nov 30, 2021

Process Execution Path

Good day. I would like to know about all possible ways to obtain the process execution path in powershell. I am aware of Get-Process *process name* | Select-Object Path, but looking for another, as this one does not provide the path in some cases. Is there any way that works in 100% cases (testing with both administrator and NT Authority\System privileges)?

1 Reply

  • AndySvints's avatar
    AndySvints
    Iron Contributor

    Hello TrapTheOnly,

    Did you look into WMI Win32_Process class and it's property ExecutablePath?

    Get-CimInstance Win32_Process

    Hope that helps.

     

Resources