PowerShell Processes

Memory is where people go wrong. The default table shows WS(K) in kilobytes, but the underlying property is WorkingSet64 in bytes. Sorting on the displayed column name does not work, and comparing against a number without units compares bytes to whatever you meant. Divide by 1MB for readable numbers, or compare against 100MB and let PowerShell handle the arithmetic.

CPU is a total, not a rate. The CPU property is cumulative processor seconds since the process started, so a long-running process looks busy even when idle. For a rate you need two samples or a performance counter.

Stop-Process is abrupt: it kills the process without letting it save or clean up. Prefer the application's own shutdown, or Stop-Process -Id with a specific id rather than -Name, which will take out every matching process at once.

For the owning user or the full command line, Get-Process is not enough. Use Get-CimInstance Win32_Process, which exposes CommandLine and can return the owner.

Sorting on WorkingSet64 rather than the displayed WS(K) column is what makes this correct. The calculated property then converts bytes to megabytes and rounds to one decimal, so the output is readable without being misleading. Select-Object -First 5 comes after the sort, which is the only order that gives you the actual top five.

• WS(K) is a display column; WorkingSet64 is the real property, in bytes.
• CPU is cumulative seconds, not current usage.
• Stop-Process kills without cleanup, and -Name can match many processes.
• Command line and owner come from Win32_Process.

Select-Object reference · Sort-Object reference · Get-Process reference