Win32_Process

$ExecutionState_map = @{
      0 = 'Unknown'
      1 = 'Other'
      2 = 'Ready'
      3 = 'Running'
      4 = 'Blocked'
      5 = 'Suspended Blocked'
      6 = 'Suspended Ready'
      7 = 'Terminated'
      8 = 'Stopped'
      9 = 'Growing'
}

switch([int]$value)
{
  0          {'Unknown'}
  1          {'Other'}
  2          {'Ready'}
  3          {'Running'}
  4          {'Blocked'}
  5          {'Suspended Blocked'}
  6          {'Suspended Ready'}
  7          {'Terminated'}
  8          {'Stopped'}
  9          {'Growing'}
  default    {"$value"}
}

Enum EnumExecutionState
{
  Unknown             = 0
  Other               = 1
  Ready               = 2
  Running             = 3
  Blocked             = 4
  Suspended_Blocked   = 5
  Suspended_Ready     = 6
  Terminated          = 7
  Stopped             = 8
  Growing             = 9
}

<# 
  this example uses a hashtable to translate raw numeric values for 
  property "ExecutionState" to friendly text

  Note: to use other properties than "ExecutionState", look up the appropriate 
  translation hashtable for the property you would like to use instead.
#>

#region define hashtable to translate raw values to friendly text

# Please note: this hashtable is specific for property "ExecutionState" 
# to translate other properties, use their translation table instead
$ExecutionState_map = @{
      0 = 'Unknown'
      1 = 'Other'
      2 = 'Ready'
      3 = 'Running'
      4 = 'Blocked'
      5 = 'Suspended Blocked'
      6 = 'Suspended Ready'
      7 = 'Terminated'
      8 = 'Stopped'
      9 = 'Growing'
}

#endregion define hashtable

#region define calculated property (to be used with Select-Object)

<#
  a calculated property is defined by a hashtable with keys "Name" and "Expression"
  "Name" defines the name of the property (in this example, it is "ExecutionState", but you can rename it to anything else)
  "Expression" defines a scriptblock that calculates the content of this property
  in this example, the scriptblock uses the hashtable defined earlier to translate each numeric
  value to its friendly text counterpart:
#>
 
$ExecutionState = @{
  Name = 'ExecutionState'
  Expression = {
    # property is an array, so process all values
    $value = $_.ExecutionState
    $ExecutionState_map[[int]$value]
  }  
}
#endregion define calculated property

# retrieve the instances, and output the properties "Caption" and "ExecutionState". The latter
# is defined by the hashtable in $ExecutionState: 
Get-CimInstance -Class Win32_Process | Select-Object -Property Caption, $ExecutionState

# ...or dump content of property ExecutionState:
$friendlyValues = Get-CimInstance -Class Win32_Process | 
    Select-Object -Property $ExecutionState |
    Select-Object -ExpandProperty ExecutionState

# output values
$friendlyValues

# output values as comma separated list
$friendlyValues -join ', '

# output values as bullet list
$friendlyValues | ForEach-Object { "- $_" }

<# 
  this example uses a hashtable to manually translate raw numeric values 
  for property "Win32_Process" to friendly text. This approach is ideal when
  there is just one instance to work with.

  Note: to use other properties than "Win32_Process", look up the appropriate 
  translation hashtable for the property you would like to use instead.
#>

#region define hashtable to translate raw values to friendly text

# Please note: this hashtable is specific for property "Win32_Process" 
# to translate other properties, use their translation table instead
$ExecutionState_map = @{
      0 = 'Unknown'
      1 = 'Other'
      2 = 'Ready'
      3 = 'Running'
      4 = 'Blocked'
      5 = 'Suspended Blocked'
      6 = 'Suspended Ready'
      7 = 'Terminated'
      8 = 'Stopped'
      9 = 'Growing'
}

#endregion define hashtable

# get one instance:
$instance = Get-CimInstance -Class Win32_Process | Select-Object -First 1

<#
  IMPORTANT: this example processes only one instance to illustrate
  the number-to-text translation. To process all instances, replace
  "Select-Object -First 1" with a "Foreach-Object" loop, and use
  the iterator variable $_ instead of $instance
#>

# query the property
$rawValue = $instance.ExecutionState  

# translate raw value to friendly text:
$friendlyName = $ExecutionState_map[[int]$rawValue]

# output value
$friendlyName

<# 
  this example uses a switch clause to translate raw numeric 
  values for property "ExecutionState" to friendly text. The switch
  clause is embedded into a calculated property so there is
  no need to refer to external variables for translation.

  Note: to use other properties than "ExecutionState", look up the appropriate 
  translation switch clause for the property you would like to use instead.
#>

#region define calculated property (to be used with Select-Object)

<#
  a calculated property is defined by a hashtable with keys "Name" and "Expression"
  "Name" defines the name of the property (in this example, it is "ExecutionState", but you can rename it to anything else)
  "Expression" defines a scriptblock that calculates the content of this property
  in this example, the scriptblock uses the hashtable defined earlier to translate each numeric
  value to its friendly text counterpart:
#>
 
$ExecutionState = @{
  Name = 'ExecutionState'
  Expression = {
    # property is an array, so process all values
    $value = $_.ExecutionState
    
    switch([int]$value)
      {
        0          {'Unknown'}
        1          {'Other'}
        2          {'Ready'}
        3          {'Running'}
        4          {'Blocked'}
        5          {'Suspended Blocked'}
        6          {'Suspended Ready'}
        7          {'Terminated'}
        8          {'Stopped'}
        9          {'Growing'}
        default    {"$value"}
      }
      
  }  
}
#endregion define calculated property

# retrieve all instances...
Get-CimInstance -ClassName Win32_Process | 
  # ...and output properties "Caption" and "ExecutionState". The latter is defined
  # by the hashtable in $ExecutionState:
  Select-Object -Property Caption, $ExecutionState

<# 
  this example translates raw values by means of type conversion
  the friendly names are defined as enumeration using the
  keyword "enum" (PowerShell 5 or better)
  
  The raw value(s) are translated to friendly text by 
  simply converting them into the enum type.
  
  Note: to use other properties than "Win32_Process", look up the appropriate 
  enum definition for the property you would like to use instead.
#>


#region define enum with value-to-text translation:
Enum EnumExecutionState
{
  Unknown             = 0
  Other               = 1
  Ready               = 2
  Running             = 3
  Blocked             = 4
  Suspended_Blocked   = 5
  Suspended_Ready     = 6
  Terminated          = 7
  Stopped             = 8
  Growing             = 9
}

#endregion define enum

# get one instance:
$instance = Get-CimInstance -Class Win32_Process | Select-Object -First 1

<#
  IMPORTANT: this example processes only one instance to focus on
  the number-to-text type conversion. 
  
  To process all instances, replace   "Select-Object -First 1" 
  with a "Foreach-Object" loop, and use the iterator variable 
  $_ instead of $instance
#>

# query the property:
$rawValue = $instance.ExecutionState

#region using strict type conversion

<#
  Note: strict type conversion fails if the raw value is 
  not defined by the enum. So if the list of allowable values
  was extended and the enum does not match the value,
  an exception is thrown
#>

# convert the property to the enum **ExecutionState** 
[EnumExecutionState]$rawValue 

# get a comma-separated string:
[EnumExecutionState]$rawValue -join ',' 
#endregion

#region using operator "-as"

<#
  Note: the operator "-as" accepts values not defined
  by the enum and returns $null instead of throwing
  an exception
#>

$rawValue -as [EnumExecutionState]
#endregion

Get-CimInstance -ClassName Win32_Process

Get-CimInstance -ClassName Win32_Process -Property *

Get-CimInstance -ClassName Win32_Process -KeyOnly

$properties = 'Caption',
              'CommandLine',
              'CreationClassName',
              'CreationDate',
              'CSCreationClassName',
              'CSName',
              'Description',
              'ExecutablePath',
              'ExecutionState',
              'Handle',
              'HandleCount',
              'InstallDate',
              'KernelModeTime',
              'MaximumWorkingSetSize',
              'MinimumWorkingSetSize',
              'Name',
              'OSCreationClassName',
              'OSName',
              'OtherOperationCount',
              'OtherTransferCount',
              'PageFaults',
              'PageFileUsage',
              'ParentProcessId',
              'PeakPageFileUsage',
              'PeakVirtualSize',
              'PeakWorkingSetSize',
              'Priority',
              'PrivatePageCount',
              'ProcessId',
              'QuotaNonPagedPoolUsage',
              'QuotaPagedPoolUsage',
              'QuotaPeakNonPagedPoolUsage',
              'QuotaPeakPagedPoolUsage',
              'ReadOperationCount',
              'ReadTransferCount',
              'SessionId',
              'Status',
              'TerminationDate',
              'ThreadCount',
              'UserModeTime',
              'VirtualSize',
              'WindowsVersion',
              'WorkingSetSize',
              'WriteOperationCount',
              'WriteTransferCount'
Get-CimInstance -ClassName Win32_Process | Select-Object -Property $properties

Get-CimInstance -Class Win32_Process -Property $property | 
Select-Object -Property $property

Get-CimInstance -Class Win32_Process -Filter 'Caption LIKE "a%"' 

Get-CimInstance -Query "SELECT TerminationDate, PeakPageFileUsage, QuotaNonPagedPoolUsage, Handle FROM Win32_Process WHERE Caption LIKE 'a%'"

# one or more computer names or IP addresses:
$list = 'server1', 'server2'

# authenticate with your current identity:
$result = Get-CimInstance -ClassName Win32_Process -ComputerName $list 
$result

# one or more computer names or IP addresses:
$list = 'server1', 'server2'

# authenticate with a different identity:
$cred = Get-Credential -Message 'Authenticate to retrieve WMI information:'
$session = New-CimSession -ComputerName $list -Credential $cred

$result = Get-CimInstance Win32_Process -CimSession $session

# remove the session after use (if you do not plan to re-use it later)
Remove-CimSession -CimSession $session

$result