49

How can I show the full EXE file path of each running process from the command-line in Windows?

I've tried tasklist and pslist, but they don't show the full path:

tasklist /FI "ImageName eq Spring.Tests.exe" /v /fo List

Gives:

Image Name:   Spring.Tests.exe
PID:          3956
Session Name: Console
Session#:     1
Mem Usage:    9,772 K
Status:       Running
User Name:    W81ENTX64DELPHI\Developer
CPU Time:     0:00:01
Window Title: Spring

and

pslist Spring.Tests -x

gives:

Name                Pid      VM      WS    Priv Priv Pk   Faults   NonP Page
Spring.Tests       3956   83472    9772    5320    5692     5037     11  157
 Tid Pri    Cswtch            State     User Time   Kernel Time   Elapsed Time
1488  10     11018     Wait:UserReq  0:00:00.906   0:00:01.046    0:53:06.977

Since Spring.Tests.exe can be in various directories, I want to know which one was executed.

8
  • 1
    oh that's a classic question.. besides task manager having a column. For command line, WMIC and powershell can. it's even on here or on stackoverflow.. must be all over the place... Actually I can't see it fully answered on here, i have a note of it.. i'll check
    – barlop
    Commented Jun 15, 2014 at 8:10
  • @barlop it's funny: while you wrote your comment, I was already experimenting with PowerShell, as I'd been doing some other PowerShell experimenting as well (: Commented Jun 15, 2014 at 16:41
  • no need for a ':(' your method is very neat and you found it fast
    – barlop
    Commented Jun 15, 2014 at 19:35
  • 1
    I must be autistic! Maybe you should put a nose in the smiley to make it clearer ;-)
    – barlop
    Commented Jul 17, 2015 at 14:24
  • 1
    @kayleeFrye_onDeck I have better success running the solutions under an elevated UAC token, but really wish there was a command-line version of technet.microsoft.com/en-us/sysinternals/processexplorer.aspx that allows reliable querying under that token. Commented Mar 30, 2017 at 6:07

5 Answers 5

46

In addition to the line you gave, here are a bunch of lines that (apart from the second one) can be used to list paths:

PS C:\> gwmi win32_process | select Handle, CommandLine | format-list
PS C:\> gwmi win32_process | select name
PS C:\> gwmi win32_process | select CommandLine
C:\>wmic process get ProcessID,ExecutablePath
C:\>wmic process where "name='mysqld.exe'" get ProcessID, ExecutablePath
C:\>wmic process where "name='mysqld.exe'" get ProcessID, ExecutablePath /FORMAT:LIST
3
  • this has the advantage of being fast, (wmic) because powershell is so god darn slow!!!
    – Mr.Robot
    Commented Feb 24, 2017 at 2:40
  • Be very attentive to the formatting used. For example, not including the single-quote marks within the name field will cause this to break. Commented Feb 7, 2018 at 1:56
  • @kayleeFrye_onDeck well, given the length of the command i'd expect somebody to just copy/paste it anyway and just change the name of the process. So hopefully they shouldn't make the mistake of missing single quotes around the process name as they can leave the ones that are there.
    – barlop
    Commented Feb 7, 2018 at 12:38
17

PowerShell to the rescue.

First I used Get-Member to see what Get-Process could return:

PowerShell Get-Process ^| Get-Member

Then I filtered the Path from Get-Process to figure out which Spring.Tests processes were running:

PowerShell Get-Process Spring.Tests ^| Format-List Path

resulting in:

Path : C:\Users\Developer\Versioned\Spring4D\Tests\Bin\DelphiXE\Spring.Tests.exe

which is exactly the information I wanted.

6
  • 1
    there is WMIC too but powershell is more modern and flexible
    – barlop
    Commented Jun 15, 2014 at 8:13
  • Is Path the same thing as command line? What about the arguments to the executable? @barlop WMI still has a number of features that are otherwise unavailable in PowerShell.
    – jpmc26
    Commented May 10, 2017 at 16:34
  • @jpmc26 I didn't need those, but I think you can get them via StartInfo instead of Path based on stackoverflow.com/questions/1012409/… Commented May 12, 2017 at 14:03
  • @jpmc26 the file paths that the wmic command outputs, are the same as the file paths that the powershell ........ command there outputs e.g. open windows calculator and try it for calc.exe pastebin.com/raw/TK8xSPPL
    – barlop
    Commented May 14, 2017 at 5:21
  • What does the carrot do in the first command? Commented Nov 21, 2017 at 14:54
14

Pipe PowerShell's Get-Process into Select-Object.

Example command for Notepad++:

Get-Process notepad++ | Select-Object Path

Output:

Path
----
D:\Notepad++\notepad++.exe
2
  • 2
    To get output directly, (Get-Process notepad++).Path (maybe to store in a variable).
    – nawfal
    Commented Dec 2, 2017 at 13:57
  • 1
    @nawfal I missed your comment back-then, but your solution is awesome! Running on cmd.exe, now PowerShell (Get-Process procexp).Path gives me C:\ProgramData\chocolatey\lib\sysinternals\tools\procexp.exe without going through the ^| redirect trick. Thanks! Commented Mar 30, 2022 at 10:23
2

In PowerShell:

General solution. To get path and other info of a process you would run:

$ Get-Process <options> | Select-Object <options>

For specific process PID you would run:

Example:

Get-Process -Id 2728 | Select-Object -Property ProcessName, Id, WS, Path

Outputs:

enter image description here

For all processes with given name, you would run:

Example:

Get-Process svchost | Select-Object -Property ProcessName, Id, WS, Path

Outputs:

enter image description here

Documentation:

SelectObject

Get-Process

1
  • For me it showed the path when Powershell was run as administrator
    – abitcode
    Commented Apr 14, 2023 at 8:33
0

I am running a file abc.txt and found the path by using this in the command line on Windows

wmic process where "CommandLine like '%abc.txt'" get commandline

You can try in a similar way.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .