Process Execution Path

%3CLINGO-SUB%20id%3D%22lingo-sub-3018368%22%20slang%3D%22en-US%22%3EProcess%20Execution%20Path%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3018368%22%20slang%3D%22en-US%22%3E%3CP%3EGood%20day.%20I%20would%20like%20to%20know%20about%20all%20possible%20ways%20to%20obtain%20the%20process%20execution%20path%20in%20powershell.%20I%20am%20aware%20of%20Get-Process%20*process%20name*%20%7C%20Select-Object%20Path%2C%20but%20looking%20for%20another%2C%20as%20this%20one%20does%20not%20provide%20the%20path%20in%20some%20cases.%20Is%20there%20any%20way%20that%20works%20in%20100%25%20cases%20(testing%20with%20both%20administrator%20and%20NT%20Authority%5CSystem%20privileges)%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-3018368%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EWindows%20PowerShell%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Occasional Visitor

Good day. I would like to know about all possible ways to obtain the process execution path in powershell. I am aware of Get-Process *process name* | Select-Object Path, but looking for another, as this one does not provide the path in some cases. Is there any way that works in 100% cases (testing with both administrator and NT Authority\System privileges)?

1 Reply

Hello @TrapTheOnly,

Did you look into WMI Win32_Process class and it's property ExecutablePath?

Get-CimInstance Win32_Process

Hope that helps.