Win32_ProcessStartup - powershell.one

The Win32_ProcessStartup abstract WMI class represents the startup configuration of a Windows-based process. The class is defined as a method type definition, which means that it is only used for passing information to the Create method of the Win32_Process class.

Methods

Win32_ProcessStartup has no methods.

Properties

Win32_ProcessStartup returns 14 properties:

'CreateFlags','EnvironmentVariables','ErrorMode','FillAttribute','PriorityClass',
'ShowWindow','Title','WinstationDesktop','X','XCountChars','XSize','Y','YCountChars','YSize'

Unless explicitly marked as writeable, all properties are read-only. Read all properties for all instances:

Get-CimInstance -ClassName Win32_ProcessStartup -Property *

Most WMI classes return one or more instances.

When Get-CimInstance returns no result, then apparently no instances of class Win32_ProcessStartup exist. This is normal behavior.

Either the class is not implemented on your system (may be deprecated or due to missing drivers, i.e. CIM_VideoControllerResolution), or there are simply no physical representations of this class currently available (i.e. Win32_TapeDrive).

CreateFlags

WRITEABLE UINT32

Additional values that control the priority class and the creation of the process. The following creation values can be specified in any combination, except as noted.

CreateFlags returns a numeric value. To translate it into a meaningful text, use any of the following approaches:

Use a PowerShell Hashtable

$CreateFlags_map = @{
      1 = 'Debug_Process'
      2 = 'Debug_Only_This_Process'
      4 = 'Create_Suspended'
      8 = 'Detached_Process'
     16 = 'Create_New_Console'
    512 = 'Create_New_Process_Group'
   1024 = 'Create_Unicode_Environment'
67108864 = 'Create_Default_Error_Mode'
16777216 = 'CREATE_BREAKAWAY_FROM_JOB'
}

Use a switch statement

switch([int]$value)
{
  1          {'Debug_Process'}
  2          {'Debug_Only_This_Process'}
  4          {'Create_Suspended'}
  8          {'Detached_Process'}
  16         {'Create_New_Console'}
  512        {'Create_New_Process_Group'}
  1024       {'Create_Unicode_Environment'}
  67108864   {'Create_Default_Error_Mode'}
  16777216   {'CREATE_BREAKAWAY_FROM_JOB'}
  default    {"$value"}
}

Use Enum structure

Enum EnumCreateFlags
{
  Debug_Process                = 1
  Debug_Only_This_Process      = 2
  Create_Suspended             = 4
  Detached_Process             = 8
  Create_New_Console           = 16
  Create_New_Process_Group     = 512
  Create_Unicode_Environment   = 1024
  Create_Default_Error_Mode    = 67108864
  CREATE_BREAKAWAY_FROM_JOB    = 16777216
}

Examples

Use $CreateFlags_map in a calculated property for Select-Object

<# 
  this example uses a hashtable to translate raw numeric values for 
  property "CreateFlags" to friendly text

  Note: to use other properties than "CreateFlags", look up the appropriate 
  translation hashtable for the property you would like to use instead.
#>

#region define hashtable to translate raw values to friendly text

# Please note: this hashtable is specific for property "CreateFlags" 
# to translate other properties, use their translation table instead
$CreateFlags_map = @{
      1 = 'Debug_Process'
      2 = 'Debug_Only_This_Process'
      4 = 'Create_Suspended'
      8 = 'Detached_Process'
     16 = 'Create_New_Console'
    512 = 'Create_New_Process_Group'
   1024 = 'Create_Unicode_Environment'
67108864 = 'Create_Default_Error_Mode'
16777216 = 'CREATE_BREAKAWAY_FROM_JOB'
}

#endregion define hashtable

#region define calculated property (to be used with Select-Object)

<#
  a calculated property is defined by a hashtable with keys "Name" and "Expression"
  "Name" defines the name of the property (in this example, it is "CreateFlags", but you can rename it to anything else)
  "Expression" defines a scriptblock that calculates the content of this property
  in this example, the scriptblock uses the hashtable defined earlier to translate each numeric
  value to its friendly text counterpart:
#>
 
$CreateFlags = @{
  Name = 'CreateFlags'
  Expression = {
    # property is an array, so process all values
    $value = $_.CreateFlags
    $CreateFlags_map[[int]$value]
  }  
}
#endregion define calculated property

# retrieve the instances, and output the properties "Caption" and "CreateFlags". The latter
# is defined by the hashtable in $CreateFlags: 
Get-CimInstance -Class Win32_ProcessStartup | Select-Object -Property Caption, $CreateFlags

# ...or dump content of property CreateFlags:
$friendlyValues = Get-CimInstance -Class Win32_ProcessStartup | 
    Select-Object -Property $CreateFlags |
    Select-Object -ExpandProperty CreateFlags

# output values
$friendlyValues

# output values as comma separated list
$friendlyValues -join ', '

# output values as bullet list
$friendlyValues | ForEach-Object { "- $_" }

Use $CreateFlags_map to directly translate raw values from an instance

<# 
  this example uses a hashtable to manually translate raw numeric values 
  for property "Win32_ProcessStartup" to friendly text. This approach is ideal when
  there is just one instance to work with.

  Note: to use other properties than "Win32_ProcessStartup", look up the appropriate 
  translation hashtable for the property you would like to use instead.
#>

#region define hashtable to translate raw values to friendly text

# Please note: this hashtable is specific for property "Win32_ProcessStartup" 
# to translate other properties, use their translation table instead
$CreateFlags_map = @{
      1 = 'Debug_Process'
      2 = 'Debug_Only_This_Process'
      4 = 'Create_Suspended'
      8 = 'Detached_Process'
     16 = 'Create_New_Console'
    512 = 'Create_New_Process_Group'
   1024 = 'Create_Unicode_Environment'
67108864 = 'Create_Default_Error_Mode'
16777216 = 'CREATE_BREAKAWAY_FROM_JOB'
}

#endregion define hashtable

# get one instance:
$instance = Get-CimInstance -Class Win32_ProcessStartup | Select-Object -First 1

<#
  IMPORTANT: this example processes only one instance to illustrate
  the number-to-text translation. To process all instances, replace
  "Select-Object -First 1" with a "Foreach-Object" loop, and use
  the iterator variable $_ instead of $instance
#>

# query the property
$rawValue = $instance.CreateFlags  

# translate raw value to friendly text:
$friendlyName = $CreateFlags_map[[int]$rawValue]

# output value
$friendlyName

Use a switch statement inside a calculated property for Select-Object

<# 
  this example uses a switch clause to translate raw numeric 
  values for property "CreateFlags" to friendly text. The switch
  clause is embedded into a calculated property so there is
  no need to refer to external variables for translation.

  Note: to use other properties than "CreateFlags", look up the appropriate 
  translation switch clause for the property you would like to use instead.
#>

#region define calculated property (to be used with Select-Object)

<#
  a calculated property is defined by a hashtable with keys "Name" and "Expression"
  "Name" defines the name of the property (in this example, it is "CreateFlags", but you can rename it to anything else)
  "Expression" defines a scriptblock that calculates the content of this property
  in this example, the scriptblock uses the hashtable defined earlier to translate each numeric
  value to its friendly text counterpart:
#>
 
$CreateFlags = @{
  Name = 'CreateFlags'
  Expression = {
    # property is an array, so process all values
    $value = $_.CreateFlags
    
    switch([int]$value)
      {
        1          {'Debug_Process'}
        2          {'Debug_Only_This_Process'}
        4          {'Create_Suspended'}
        8          {'Detached_Process'}
        16         {'Create_New_Console'}
        512        {'Create_New_Process_Group'}
        1024       {'Create_Unicode_Environment'}
        67108864   {'Create_Default_Error_Mode'}
        16777216   {'CREATE_BREAKAWAY_FROM_JOB'}
        default    {"$value"}
      }
      
  }  
}
#endregion define calculated property

# retrieve all instances...
Get-CimInstance -ClassName Win32_ProcessStartup | 
  # ...and output properties "Caption" and "CreateFlags". The latter is defined
  # by the hashtable in $CreateFlags:
  Select-Object -Property Caption, $CreateFlags

Use the Enum from above to auto-translate the code values

<# 
  this example translates raw values by means of type conversion
  the friendly names are defined as enumeration using the
  keyword "enum" (PowerShell 5 or better)
  
  The raw value(s) are translated to friendly text by 
  simply converting them into the enum type.
  
  Note: to use other properties than "Win32_ProcessStartup", look up the appropriate 
  enum definition for the property you would like to use instead.
#>


#region define enum with value-to-text translation:
Enum EnumCreateFlags
{
  Debug_Process                = 1
  Debug_Only_This_Process      = 2
  Create_Suspended             = 4
  Detached_Process             = 8
  Create_New_Console           = 16
  Create_New_Process_Group     = 512
  Create_Unicode_Environment   = 1024
  Create_Default_Error_Mode    = 67108864
  CREATE_BREAKAWAY_FROM_JOB    = 16777216
}

#endregion define enum

# get one instance:
$instance = Get-CimInstance -Class Win32_ProcessStartup | Select-Object -First 1

<#
  IMPORTANT: this example processes only one instance to focus on
  the number-to-text type conversion. 
  
  To process all instances, replace   "Select-Object -First 1" 
  with a "Foreach-Object" loop, and use the iterator variable 
  $_ instead of $instance
#>

# query the property:
$rawValue = $instance.CreateFlags

#region using strict type conversion

<#
  Note: strict type conversion fails if the raw value is 
  not defined by the enum. So if the list of allowable values
  was extended and the enum does not match the value,
  an exception is thrown
#>

# convert the property to the enum **CreateFlags** 
[EnumCreateFlags]$rawValue 

# get a comma-separated string:
[EnumCreateFlags]$rawValue -join ',' 
#endregion

#region using operator "-as"

<#
  Note: the operator "-as" accepts values not defined
  by the enum and returns $null instead of throwing
  an exception
#>

$rawValue -as [EnumCreateFlags]
#endregion

Enums must cover all possible values. If CreateFlags returns a value that is not defined in the enum, an exception occurs. The exception reports the value that was missing in the enum. To fix, add the missing value to the enum.

EnvironmentVariables

WRITEABLE STRING ARRAY

List of settings for the configuration of a computer. Environment variables specify search paths for files, directories for temporary files, application-specific options, and other similar information. The system maintains a block of environment settings for each user and one for the computer. The system environment block represents environment variables for all of the users of a specific computer. A user’s environment block represents the environment variables that the system maintains for a specific user, and includes the set of system environment variables. By default, each process receives a copy of the environment block for its parent process. Typically, this is the environment block for the user who is logged on. A process can specify different environment blocks for its child processes.

Get-CimInstance -ClassName Win32_ProcessStartup | Select-Object -Property EnvironmentVariables

ErrorMode

WRITEABLE UINT16

On some non-x86 processors, misaligned memory references cause an alignment fault exception. The No_Alignment_Fault_Except flag lets you control whether or not an operating system automatically fixes such alignment faults, or makes them visible to an application. On a millions of instructions per second (MIPS) platform, an application must explicitly call SetErrorMode with the No_Alignment_Fault_Except flag to have the operating system automatically fix alignment faults.

How an operating system processes several types of serious errors. You can specify that the operating system process errors, or an application can receive and process errors.

The default setting is for the operating system to make alignment faults visible to an application. Because the x86 platform does not make alignment faults visible to an application, the No_Alignment_Fault_Except flag does not make the operating system raise an alignment fault errorâeven if the flag is not set. The default state for SetErrorMode is to set all of the flags to 0 (zero).

(1)

Default

ErrorMode returns a numeric value. To translate it into a meaningful text, use any of the following approaches:

Use a PowerShell Hashtable

$ErrorMode_map = @{
      2 = 'Fail_Critical_Errors'
      4 = 'No_Alignment_Fault_Except'
      8 = 'No_GP_Fault_Error_Box'
     16 = 'No_Open_File_Error_Box'
}

Use a switch statement

switch([int]$value)
{
  2          {'Fail_Critical_Errors'}
  4          {'No_Alignment_Fault_Except'}
  8          {'No_GP_Fault_Error_Box'}
  16         {'No_Open_File_Error_Box'}
  default    {"$value"}
}

Use Enum structure

Enum EnumErrorMode
{
  Fail_Critical_Errors        = 2
  No_Alignment_Fault_Except   = 4
  No_GP_Fault_Error_Box       = 8
  No_Open_File_Error_Box      = 16
}

Examples

Use $ErrorMode_map in a calculated property for Select-Object

<# 
  this example uses a hashtable to translate raw numeric values for 
  property "ErrorMode" to friendly text

  Note: to use other properties than "ErrorMode", look up the appropriate 
  translation hashtable for the property you would like to use instead.
#>

#region define hashtable to translate raw values to friendly text

# Please note: this hashtable is specific for property "ErrorMode" 
# to translate other properties, use their translation table instead
$ErrorMode_map = @{
      2 = 'Fail_Critical_Errors'
      4 = 'No_Alignment_Fault_Except'
      8 = 'No_GP_Fault_Error_Box'
     16 = 'No_Open_File_Error_Box'
}

#endregion define hashtable

#region define calculated property (to be used with Select-Object)

<#
  a calculated property is defined by a hashtable with keys "Name" and "Expression"
  "Name" defines the name of the property (in this example, it is "ErrorMode", but you can rename it to anything else)
  "Expression" defines a scriptblock that calculates the content of this property
  in this example, the scriptblock uses the hashtable defined earlier to translate each numeric
  value to its friendly text counterpart:
#>
 
$ErrorMode = @{
  Name = 'ErrorMode'
  Expression = {
    # property is an array, so process all values
    $value = $_.ErrorMode
    $ErrorMode_map[[int]$value]
  }  
}
#endregion define calculated property

# retrieve the instances, and output the properties "Caption" and "ErrorMode". The latter
# is defined by the hashtable in $ErrorMode: 
Get-CimInstance -Class Win32_ProcessStartup | Select-Object -Property Caption, $ErrorMode

# ...or dump content of property ErrorMode:
$friendlyValues = Get-CimInstance -Class Win32_ProcessStartup | 
    Select-Object -Property $ErrorMode |
    Select-Object -ExpandProperty ErrorMode

# output values
$friendlyValues

# output values as comma separated list
$friendlyValues -join ', '

# output values as bullet list
$friendlyValues | ForEach-Object { "- $_" }

Use $ErrorMode_map to directly translate raw values from an instance

<# 
  this example uses a hashtable to manually translate raw numeric values 
  for property "Win32_ProcessStartup" to friendly text. This approach is ideal when
  there is just one instance to work with.

  Note: to use other properties than "Win32_ProcessStartup", look up the appropriate 
  translation hashtable for the property you would like to use instead.
#>

#region define hashtable to translate raw values to friendly text

# Please note: this hashtable is specific for property "Win32_ProcessStartup" 
# to translate other properties, use their translation table instead
$ErrorMode_map = @{
      2 = 'Fail_Critical_Errors'
      4 = 'No_Alignment_Fault_Except'
      8 = 'No_GP_Fault_Error_Box'
     16 = 'No_Open_File_Error_Box'
}

#endregion define hashtable

# get one instance:
$instance = Get-CimInstance -Class Win32_ProcessStartup | Select-Object -First 1

<#
  IMPORTANT: this example processes only one instance to illustrate
  the number-to-text translation. To process all instances, replace
  "Select-Object -First 1" with a "Foreach-Object" loop, and use
  the iterator variable $_ instead of $instance
#>

# query the property
$rawValue = $instance.ErrorMode  

# translate raw value to friendly text:
$friendlyName = $ErrorMode_map[[int]$rawValue]

# output value
$friendlyName

Use a switch statement inside a calculated property for Select-Object

<# 
  this example uses a switch clause to translate raw numeric 
  values for property "ErrorMode" to friendly text. The switch
  clause is embedded into a calculated property so there is
  no need to refer to external variables for translation.

  Note: to use other properties than "ErrorMode", look up the appropriate 
  translation switch clause for the property you would like to use instead.
#>

#region define calculated property (to be used with Select-Object)

<#
  a calculated property is defined by a hashtable with keys "Name" and "Expression"
  "Name" defines the name of the property (in this example, it is "ErrorMode", but you can rename it to anything else)
  "Expression" defines a scriptblock that calculates the content of this property
  in this example, the scriptblock uses the hashtable defined earlier to translate each numeric
  value to its friendly text counterpart:
#>
 
$ErrorMode = @{
  Name = 'ErrorMode'
  Expression = {
    # property is an array, so process all values
    $value = $_.ErrorMode
    
    switch([int]$value)
      {
        2          {'Fail_Critical_Errors'}
        4          {'No_Alignment_Fault_Except'}
        8          {'No_GP_Fault_Error_Box'}
        16         {'No_Open_File_Error_Box'}
        default    {"$value"}
      }
      
  }  
}
#endregion define calculated property

# retrieve all instances...
Get-CimInstance -ClassName Win32_ProcessStartup | 
  # ...and output properties "Caption" and "ErrorMode". The latter is defined
  # by the hashtable in $ErrorMode:
  Select-Object -Property Caption, $ErrorMode

Use the Enum from above to auto-translate the code values

<# 
  this example translates raw values by means of type conversion
  the friendly names are defined as enumeration using the
  keyword "enum" (PowerShell 5 or better)
  
  The raw value(s) are translated to friendly text by 
  simply converting them into the enum type.
  
  Note: to use other properties than "Win32_ProcessStartup", look up the appropriate 
  enum definition for the property you would like to use instead.
#>


#region define enum with value-to-text translation:
Enum EnumErrorMode
{
  Fail_Critical_Errors        = 2
  No_Alignment_Fault_Except   = 4
  No_GP_Fault_Error_Box       = 8
  No_Open_File_Error_Box      = 16
}

#endregion define enum

# get one instance:
$instance = Get-CimInstance -Class Win32_ProcessStartup | Select-Object -First 1

<#
  IMPORTANT: this example processes only one instance to focus on
  the number-to-text type conversion. 
  
  To process all instances, replace   "Select-Object -First 1" 
  with a "Foreach-Object" loop, and use the iterator variable 
  $_ instead of $instance
#>

# query the property:
$rawValue = $instance.ErrorMode

#region using strict type conversion

<#
  Note: strict type conversion fails if the raw value is 
  not defined by the enum. So if the list of allowable values
  was extended and the enum does not match the value,
  an exception is thrown
#>

# convert the property to the enum **ErrorMode** 
[EnumErrorMode]$rawValue 

# get a comma-separated string:
[EnumErrorMode]$rawValue -join ',' 
#endregion

#region using operator "-as"

<#
  Note: the operator "-as" accepts values not defined
  by the enum and returns $null instead of throwing
  an exception
#>

$rawValue -as [EnumErrorMode]
#endregion

Enums must cover all possible values. If ErrorMode returns a value that is not defined in the enum, an exception occurs. The exception reports the value that was missing in the enum. To fix, add the missing value to the enum.

FillAttribute

WRITEABLE UINT32

The text and background colors if a new console window is created in a console application. These values are ignored in graphical user interface (GUI) applications. To specify both foreground and background colors, add the values together. For example, to have red type (4) on a blue background (16), set the FillAttribute to 20.

Foreground_Blue

Foreground_Green

Foreground_Red

Foreground_Intensity

Background_Blue

Background_Green

Background_Red

128

Background_Intensity

Get-CimInstance -ClassName Win32_ProcessStartup | Select-Object -Property FillAttribute

PriorityClass

WRITEABLE UINT32

Priority class of the new process. Use this property to determine the schedule priorities of the threads in the process. If the property is left null, the priority class defaults to Normalâunless the priority class of the creating process is Idle or Below_Normal. In these cases, the child process receives the default priority class of the calling process.

PriorityClass returns a numeric value. To translate it into a meaningful text, use any of the following approaches:

Use a PowerShell Hashtable

$PriorityClass_map = @{
= 'Normal'
= 'Idle'
= 'High'
= 'Realtime'
= 'Below_Normal'
= 'Above_Normal'
}

Use a switch statement

switch([int]$value)
{
  32         {'Normal'}
  64         {'Idle'}
  128        {'High'}
  256        {'Realtime'}
  16384      {'Below_Normal'}
  32768      {'Above_Normal'}
  default    {"$value"}
}

Use Enum structure

Enum EnumPriorityClass
{
  Normal         = 32
  Idle           = 64
  High           = 128
  Realtime       = 256
  Below_Normal   = 16384
  Above_Normal   = 32768
}

Examples

Use $PriorityClass_map in a calculated property for Select-Object

<# 
  this example uses a hashtable to translate raw numeric values for 
  property "PriorityClass" to friendly text

  Note: to use other properties than "PriorityClass", look up the appropriate 
  translation hashtable for the property you would like to use instead.
#>

#region define hashtable to translate raw values to friendly text

# Please note: this hashtable is specific for property "PriorityClass" 
# to translate other properties, use their translation table instead
$PriorityClass_map = @{
     32 = 'Normal'
     64 = 'Idle'
    128 = 'High'
    256 = 'Realtime'
  16384 = 'Below_Normal'
  32768 = 'Above_Normal'
}

#endregion define hashtable

#region define calculated property (to be used with Select-Object)

<#
  a calculated property is defined by a hashtable with keys "Name" and "Expression"
  "Name" defines the name of the property (in this example, it is "PriorityClass", but you can rename it to anything else)
  "Expression" defines a scriptblock that calculates the content of this property
  in this example, the scriptblock uses the hashtable defined earlier to translate each numeric
  value to its friendly text counterpart:
#>
 
$PriorityClass = @{
  Name = 'PriorityClass'
  Expression = {
    # property is an array, so process all values
    $value = $_.PriorityClass
    $PriorityClass_map[[int]$value]
  }  
}
#endregion define calculated property

# retrieve the instances, and output the properties "Caption" and "PriorityClass". The latter
# is defined by the hashtable in $PriorityClass: 
Get-CimInstance -Class Win32_ProcessStartup | Select-Object -Property Caption, $PriorityClass

# ...or dump content of property PriorityClass:
$friendlyValues = Get-CimInstance -Class Win32_ProcessStartup | 
    Select-Object -Property $PriorityClass |
    Select-Object -ExpandProperty PriorityClass

# output values
$friendlyValues

# output values as comma separated list
$friendlyValues -join ', '

# output values as bullet list
$friendlyValues | ForEach-Object { "- $_" }

Use $PriorityClass_map to directly translate raw values from an instance

<# 
  this example uses a hashtable to manually translate raw numeric values 
  for property "Win32_ProcessStartup" to friendly text. This approach is ideal when
  there is just one instance to work with.

  Note: to use other properties than "Win32_ProcessStartup", look up the appropriate 
  translation hashtable for the property you would like to use instead.
#>

#region define hashtable to translate raw values to friendly text

# Please note: this hashtable is specific for property "Win32_ProcessStartup" 
# to translate other properties, use their translation table instead
$PriorityClass_map = @{
     32 = 'Normal'
     64 = 'Idle'
    128 = 'High'
    256 = 'Realtime'
  16384 = 'Below_Normal'
  32768 = 'Above_Normal'
}

#endregion define hashtable

# get one instance:
$instance = Get-CimInstance -Class Win32_ProcessStartup | Select-Object -First 1

<#
  IMPORTANT: this example processes only one instance to illustrate
  the number-to-text translation. To process all instances, replace
  "Select-Object -First 1" with a "Foreach-Object" loop, and use
  the iterator variable $_ instead of $instance
#>

# query the property
$rawValue = $instance.PriorityClass  

# translate raw value to friendly text:
$friendlyName = $PriorityClass_map[[int]$rawValue]

# output value
$friendlyName

Use a switch statement inside a calculated property for Select-Object

<# 
  this example uses a switch clause to translate raw numeric 
  values for property "PriorityClass" to friendly text. The switch
  clause is embedded into a calculated property so there is
  no need to refer to external variables for translation.

  Note: to use other properties than "PriorityClass", look up the appropriate 
  translation switch clause for the property you would like to use instead.
#>

#region define calculated property (to be used with Select-Object)

<#
  a calculated property is defined by a hashtable with keys "Name" and "Expression"
  "Name" defines the name of the property (in this example, it is "PriorityClass", but you can rename it to anything else)
  "Expression" defines a scriptblock that calculates the content of this property
  in this example, the scriptblock uses the hashtable defined earlier to translate each numeric
  value to its friendly text counterpart:
#>
 
$PriorityClass = @{
  Name = 'PriorityClass'
  Expression = {
    # property is an array, so process all values
    $value = $_.PriorityClass
    
    switch([int]$value)
      {
        32         {'Normal'}
        64         {'Idle'}
        128        {'High'}
        256        {'Realtime'}
        16384      {'Below_Normal'}
        32768      {'Above_Normal'}
        default    {"$value"}
      }
      
  }  
}
#endregion define calculated property

# retrieve all instances...
Get-CimInstance -ClassName Win32_ProcessStartup | 
  # ...and output properties "Caption" and "PriorityClass". The latter is defined
  # by the hashtable in $PriorityClass:
  Select-Object -Property Caption, $PriorityClass

Use the Enum from above to auto-translate the code values

<# 
  this example translates raw values by means of type conversion
  the friendly names are defined as enumeration using the
  keyword "enum" (PowerShell 5 or better)
  
  The raw value(s) are translated to friendly text by 
  simply converting them into the enum type.
  
  Note: to use other properties than "Win32_ProcessStartup", look up the appropriate 
  enum definition for the property you would like to use instead.
#>


#region define enum with value-to-text translation:
Enum EnumPriorityClass
{
  Normal         = 32
  Idle           = 64
  High           = 128
  Realtime       = 256
  Below_Normal   = 16384
  Above_Normal   = 32768
}

#endregion define enum

# get one instance:
$instance = Get-CimInstance -Class Win32_ProcessStartup | Select-Object -First 1

<#
  IMPORTANT: this example processes only one instance to focus on
  the number-to-text type conversion. 
  
  To process all instances, replace   "Select-Object -First 1" 
  with a "Foreach-Object" loop, and use the iterator variable 
  $_ instead of $instance
#>

# query the property:
$rawValue = $instance.PriorityClass

#region using strict type conversion

<#
  Note: strict type conversion fails if the raw value is 
  not defined by the enum. So if the list of allowable values
  was extended and the enum does not match the value,
  an exception is thrown
#>

# convert the property to the enum **PriorityClass** 
[EnumPriorityClass]$rawValue 

# get a comma-separated string:
[EnumPriorityClass]$rawValue -join ',' 
#endregion

#region using operator "-as"

<#
  Note: the operator "-as" accepts values not defined
  by the enum and returns $null instead of throwing
  an exception
#>

$rawValue -as [EnumPriorityClass]
#endregion

Enums must cover all possible values. If PriorityClass returns a value that is not defined in the enum, an exception occurs. The exception reports the value that was missing in the enum. To fix, add the missing value to the enum.

ShowWindow

WRITEABLE UINT16

How the window is displayed to the user.

ShowWindow returns a numeric value. To translate it into a meaningful text, use any of the following approaches:

Use a PowerShell Hashtable

$ShowWindow_map = @{
= 'SW_HIDE'
= 'SW_NORMAL'
= 'SW_SHOWMINIMIZED'
= 'SW_SHOWMAXIMIZED'
= 'SW_SHOWNOACTIVATE'
= 'SW_SHOW'
= 'SW_MINIMIZE'
= 'SW_SHOWMINNOACTIVE'
= 'SW_SHOWNA'
= 'SW_RESTORE'
= 'SW_SHOWDEFAULT'
= 'SW_FORCEMINIMIZE'
}

Use a switch statement

switch([int]$value)
{
        {'SW_HIDE'}
        {'SW_NORMAL'}
        {'SW_SHOWMINIMIZED'}
        {'SW_SHOWMAXIMIZED'}
        {'SW_SHOWNOACTIVATE'}
        {'SW_SHOW'}
        {'SW_MINIMIZE'}
        {'SW_SHOWMINNOACTIVE'}
        {'SW_SHOWNA'}
        {'SW_RESTORE'}
       {'SW_SHOWDEFAULT'}
       {'SW_FORCEMINIMIZE'}
  default    {"$value"}
}

Use Enum structure

Enum EnumShowWindow
{
  SW_HIDE              = 0
  SW_NORMAL            = 1
  SW_SHOWMINIMIZED     = 2
  SW_SHOWMAXIMIZED     = 3
  SW_SHOWNOACTIVATE    = 4
  SW_SHOW              = 5
  SW_MINIMIZE          = 6
  SW_SHOWMINNOACTIVE   = 7
  SW_SHOWNA            = 8
  SW_RESTORE           = 9
  SW_SHOWDEFAULT       = 10
  SW_FORCEMINIMIZE     = 11
}

Examples

Use $ShowWindow_map in a calculated property for Select-Object

<# 
  this example uses a hashtable to translate raw numeric values for 
  property "ShowWindow" to friendly text

  Note: to use other properties than "ShowWindow", look up the appropriate 
  translation hashtable for the property you would like to use instead.
#>

#region define hashtable to translate raw values to friendly text

# Please note: this hashtable is specific for property "ShowWindow" 
# to translate other properties, use their translation table instead
$ShowWindow_map = @{
      0 = 'SW_HIDE'
      1 = 'SW_NORMAL'
      2 = 'SW_SHOWMINIMIZED'
      3 = 'SW_SHOWMAXIMIZED'
      4 = 'SW_SHOWNOACTIVATE'
      5 = 'SW_SHOW'
      6 = 'SW_MINIMIZE'
      7 = 'SW_SHOWMINNOACTIVE'
      8 = 'SW_SHOWNA'
      9 = 'SW_RESTORE'
     10 = 'SW_SHOWDEFAULT'
     11 = 'SW_FORCEMINIMIZE'
}

#endregion define hashtable

#region define calculated property (to be used with Select-Object)

<#
  a calculated property is defined by a hashtable with keys "Name" and "Expression"
  "Name" defines the name of the property (in this example, it is "ShowWindow", but you can rename it to anything else)
  "Expression" defines a scriptblock that calculates the content of this property
  in this example, the scriptblock uses the hashtable defined earlier to translate each numeric
  value to its friendly text counterpart:
#>
 
$ShowWindow = @{
  Name = 'ShowWindow'
  Expression = {
    # property is an array, so process all values
    $value = $_.ShowWindow
    $ShowWindow_map[[int]$value]
  }  
}
#endregion define calculated property

# retrieve the instances, and output the properties "Caption" and "ShowWindow". The latter
# is defined by the hashtable in $ShowWindow: 
Get-CimInstance -Class Win32_ProcessStartup | Select-Object -Property Caption, $ShowWindow

# ...or dump content of property ShowWindow:
$friendlyValues = Get-CimInstance -Class Win32_ProcessStartup | 
    Select-Object -Property $ShowWindow |
    Select-Object -ExpandProperty ShowWindow

# output values
$friendlyValues

# output values as comma separated list
$friendlyValues -join ', '

# output values as bullet list
$friendlyValues | ForEach-Object { "- $_" }

Use $ShowWindow_map to directly translate raw values from an instance

<# 
  this example uses a hashtable to manually translate raw numeric values 
  for property "Win32_ProcessStartup" to friendly text. This approach is ideal when
  there is just one instance to work with.

  Note: to use other properties than "Win32_ProcessStartup", look up the appropriate 
  translation hashtable for the property you would like to use instead.
#>

#region define hashtable to translate raw values to friendly text

# Please note: this hashtable is specific for property "Win32_ProcessStartup" 
# to translate other properties, use their translation table instead
$ShowWindow_map = @{
      0 = 'SW_HIDE'
      1 = 'SW_NORMAL'
      2 = 'SW_SHOWMINIMIZED'
      3 = 'SW_SHOWMAXIMIZED'
      4 = 'SW_SHOWNOACTIVATE'
      5 = 'SW_SHOW'
      6 = 'SW_MINIMIZE'
      7 = 'SW_SHOWMINNOACTIVE'
      8 = 'SW_SHOWNA'
      9 = 'SW_RESTORE'
     10 = 'SW_SHOWDEFAULT'
     11 = 'SW_FORCEMINIMIZE'
}

#endregion define hashtable

# get one instance:
$instance = Get-CimInstance -Class Win32_ProcessStartup | Select-Object -First 1

<#
  IMPORTANT: this example processes only one instance to illustrate
  the number-to-text translation. To process all instances, replace
  "Select-Object -First 1" with a "Foreach-Object" loop, and use
  the iterator variable $_ instead of $instance
#>

# query the property
$rawValue = $instance.ShowWindow  

# translate raw value to friendly text:
$friendlyName = $ShowWindow_map[[int]$rawValue]

# output value
$friendlyName

Use a switch statement inside a calculated property for Select-Object

<# 
  this example uses a switch clause to translate raw numeric 
  values for property "ShowWindow" to friendly text. The switch
  clause is embedded into a calculated property so there is
  no need to refer to external variables for translation.

  Note: to use other properties than "ShowWindow", look up the appropriate 
  translation switch clause for the property you would like to use instead.
#>

#region define calculated property (to be used with Select-Object)

<#
  a calculated property is defined by a hashtable with keys "Name" and "Expression"
  "Name" defines the name of the property (in this example, it is "ShowWindow", but you can rename it to anything else)
  "Expression" defines a scriptblock that calculates the content of this property
  in this example, the scriptblock uses the hashtable defined earlier to translate each numeric
  value to its friendly text counterpart:
#>
 
$ShowWindow = @{
  Name = 'ShowWindow'
  Expression = {
    # property is an array, so process all values
    $value = $_.ShowWindow
    
    switch([int]$value)
      {
        0          {'SW_HIDE'}
        1          {'SW_NORMAL'}
        2          {'SW_SHOWMINIMIZED'}
        3          {'SW_SHOWMAXIMIZED'}
        4          {'SW_SHOWNOACTIVATE'}
        5          {'SW_SHOW'}
        6          {'SW_MINIMIZE'}
        7          {'SW_SHOWMINNOACTIVE'}
        8          {'SW_SHOWNA'}
        9          {'SW_RESTORE'}
        10         {'SW_SHOWDEFAULT'}
        11         {'SW_FORCEMINIMIZE'}
        default    {"$value"}
      }
      
  }  
}
#endregion define calculated property

# retrieve all instances...
Get-CimInstance -ClassName Win32_ProcessStartup | 
  # ...and output properties "Caption" and "ShowWindow". The latter is defined
  # by the hashtable in $ShowWindow:
  Select-Object -Property Caption, $ShowWindow

Use the Enum from above to auto-translate the code values

<# 
  this example translates raw values by means of type conversion
  the friendly names are defined as enumeration using the
  keyword "enum" (PowerShell 5 or better)
  
  The raw value(s) are translated to friendly text by 
  simply converting them into the enum type.
  
  Note: to use other properties than "Win32_ProcessStartup", look up the appropriate 
  enum definition for the property you would like to use instead.
#>


#region define enum with value-to-text translation:
Enum EnumShowWindow
{
  SW_HIDE              = 0
  SW_NORMAL            = 1
  SW_SHOWMINIMIZED     = 2
  SW_SHOWMAXIMIZED     = 3
  SW_SHOWNOACTIVATE    = 4
  SW_SHOW              = 5
  SW_MINIMIZE          = 6
  SW_SHOWMINNOACTIVE   = 7
  SW_SHOWNA            = 8
  SW_RESTORE           = 9
  SW_SHOWDEFAULT       = 10
  SW_FORCEMINIMIZE     = 11
}

#endregion define enum

# get one instance:
$instance = Get-CimInstance -Class Win32_ProcessStartup | Select-Object -First 1

<#
  IMPORTANT: this example processes only one instance to focus on
  the number-to-text type conversion. 
  
  To process all instances, replace   "Select-Object -First 1" 
  with a "Foreach-Object" loop, and use the iterator variable 
  $_ instead of $instance
#>

# query the property:
$rawValue = $instance.ShowWindow

#region using strict type conversion

<#
  Note: strict type conversion fails if the raw value is 
  not defined by the enum. So if the list of allowable values
  was extended and the enum does not match the value,
  an exception is thrown
#>

# convert the property to the enum **ShowWindow** 
[EnumShowWindow]$rawValue 

# get a comma-separated string:
[EnumShowWindow]$rawValue -join ',' 
#endregion

#region using operator "-as"

<#
  Note: the operator "-as" accepts values not defined
  by the enum and returns $null instead of throwing
  an exception
#>

$rawValue -as [EnumShowWindow]
#endregion

Enums must cover all possible values. If ShowWindow returns a value that is not defined in the enum, an exception occurs. The exception reports the value that was missing in the enum. To fix, add the missing value to the enum.

Title

WRITEABLE STRING

Text displayed in the title bar when a new console window is created; used for console processes. If NULL, the name of the executable file is used as the window title. This property must be NULL for GUI or console processes that do not create a new console window.

Get-CimInstance -ClassName Win32_ProcessStartup | Select-Object -Property Title

WinstationDesktop

WRITEABLE STRING

The name of the desktop or the name of both the desktop and window station for the process. A backslash in the string indicates that the string includes both desktop and window station names. If WinstationDesktop is NULL, the new process inherits the desktop and window station of its parent process. If WinstationDesktop is an empty string, the process does not inherit the desktop and window station of its parent process. The system determines if a new desktop and window station must be created. A window station is a secure object that contains a clipboard, a set of global atoms, and a group of desktop objects. The interactive window station that is assigned to the logon session of the interactive user also contains the keyboard, mouse, and display device. A desktop is a secure object contained within a window station. A desktop has a logical display surface and contains windows, menus, and hooks. A window station can have multiple desktops. Only the desktops of the interactive window station can be visible and receive user input.

Get-CimInstance -ClassName Win32_ProcessStartup | Select-Object -Property WinstationDesktop

X

WRITEABLE UINT32

The X offset of the upper left corner of a window if a new window is createdâin pixels. The offsets are from the upper left corner of the screen. For GUI processes, the specified position is used the first time the new process calls CreateWindow to create an overlapped window if the X parameter of CreateWindow is CW_USEDEFAULT.

[!Note® ® X]

and Y cannot be specified independently.

Get-CimInstance -ClassName Win32_ProcessStartup | Select-Object -Property X

XCountChars

WRITEABLE UINT32

Screen buffer width in character columns. This property is used for processes that create a console window, and is ignored in GUI processes.

Note

XCountChars and YCountChars cannot be specified independently.

Get-CimInstance -ClassName Win32_ProcessStartup | Select-Object -Property XCountChars

XSize

WRITEABLE UINT32

Pixel width of a window if a new window is created. For GUI processes, this is only used the first time the new process calls CreateWindow to create an overlapped window if the nWidth parameter of CreateWindow is CW_USEDEFAULT.

Note

XSize and YSize cannot be specified independently.

Get-CimInstance -ClassName Win32_ProcessStartup | Select-Object -Property XSize

Y

WRITEABLE UINT32

Pixel offset of the upper-left corner of a window if a new window is created. The offsets are from the upper-left corner of the screen. For GUI processes, the specified position is used the first time the new process calls CreateWindow to create an overlapped window if the y parameter of CreateWindow is CW_USEDEFAULT.

[!Note® ® X]

and Y cannot be specified independently.

Get-CimInstance -ClassName Win32_ProcessStartup | Select-Object -Property Y

YCountChars

WRITEABLE UINT32

Screen buffer height in character rows. This property is used for processes that create a console window, but is ignored in GUI processes.

Note

XCountChars and YCountChars cannot be specified independently.

Get-CimInstance -ClassName Win32_ProcessStartup | Select-Object -Property YCountChars

YSize

WRITEABLE UINT32

Pixel height of a window if a new window is created. For GUI processes, this is used only the first time the new process calls CreateWindow to create an overlapped window if the nWidth parameter of CreateWindow is CW_USEDEFAULT.

Note

XSize and YSize cannot be specified independently.

Get-CimInstance -ClassName Win32_ProcessStartup | Select-Object -Property YSize

Examples

List all instances of Win32_ProcessStartup

Get-CimInstance -ClassName Win32_ProcessStartup

Learn more about Get-CimInstance and the deprecated Get-WmiObject.

View all properties

Get-CimInstance -ClassName Win32_ProcessStartup -Property *

View key properties only

Get-CimInstance -ClassName Win32_ProcessStartup -KeyOnly

Selecting Properties

To select only some properties, pipe the results to Select-Object -Property a,b,c with a comma-separated list of the properties you require. Wildcards are permitted.

Get-CimInstance always returns all properties but only retrieves the ones that you specify. All other properties are empty but still present. That’s why you need to pipe the results into Select-Object if you want to limit the visible properties, i.e. for reporting.

Selecting Properties

The code below lists all available properties. Remove the ones you do not need:

$properties = 'CreateFlags',
              'EnvironmentVariables',
              'ErrorMode',
              'FillAttribute',
              'PriorityClass',
              'ShowWindow',
              'Title',
              'WinstationDesktop',
              'X',
              'XCountChars',
              'XSize',
              'Y',
              'YCountChars',
              'YSize'
Get-CimInstance -ClassName Win32_ProcessStartup | Select-Object -Property $properties

Limiting Network Bandwidth

If you work remotely, it makes sense to limit network bandwidth by filtering the properties on the server side, too:

Get-CimInstance -Class Win32_ProcessStartup -Property $property | 
Select-Object -Property $property

Selecting Instances

To select some instances, use Get-CimInstance and a WMI Query. The wildcard character in WMI Queries is % (and not “*”).

The parameter -Filter runs a simple query.

Listing all instances where the property Caption starts with “A”

Get-CimInstance -Class Win32_ProcessStartup -Filter 'Caption LIKE "a%"' 

Using a WQL Query

The parameter -Query uses a query similar to SQL and combines the parameters -Filter and -Property. This returns all instances where the property Caption starts with “A”, and returns the properties specified:

Get-CimInstance -Query "SELECT Y, ShowWindow, X, YSize FROM Win32_ProcessStartup WHERE Caption LIKE 'a%'"

Any property you did not specify is still present but empty. You might need to use Select-Object to remove all unwanted properties:
Get-CimInstance -Query "SELECT Y, ShowWindow, X, YSize FROM Win32_ProcessStartup WHERE Caption LIKE 'a%'" | Select-Object -Property Y, ShowWindow, X, YSize

Accessing Remote Computers

To access remote systems, you need to have proper permissions. User the parameter -ComputerName to access one or more remote systems.

Authenticating as Current User

# one or more computer names or IP addresses:
$list = 'server1', 'server2'

# authenticate with your current identity:
$result = Get-CimInstance -ClassName Win32_ProcessStartup -ComputerName $list 
$result

Authenticating as Different User

Use a CIMSession object to authenticate with a new identity:

# one or more computer names or IP addresses:
$list = 'server1', 'server2'

# authenticate with a different identity:
$cred = Get-Credential -Message 'Authenticate to retrieve WMI information:'
$session = New-CimSession -ComputerName $list -Credential $cred

$result = Get-CimInstance Win32_ProcessStartup -CimSession $session

# remove the session after use (if you do not plan to re-use it later)
Remove-CimSession -CimSession $session

$result

Learn more about accessing remote computers.

Requirements

To use Win32_ProcessStartup, the following requirements apply:

PowerShell

Get-CimInstance was introduced with PowerShell Version 3.0, which in turn was introduced on clients with Windows 8 and on servers with Windows Server 2012.

If necessary, update Windows PowerShell to Windows PowerShell 5.1, or install PowerShell 7 side-by-side.

Operating System

Win32_ProcessStartup was introduced on clients with WindowsÂ Vista and on servers with Windows ServerÂ 2008.

Namespace

Win32_ProcessStartup lives in the Namespace Root/CIMV2. This is the default namespace. There is no need to use the -Namespace parameter in Get-CimInstance.

Implementation

Win32_ProcessStartup is implemented in CIMWin32.dll and defined in CIMWin32.mof. Both files are located in the folder C:\Windows\system32\wbem:

explorer $env:windir\system32\wbem
notepad $env:windir\system32\wbem\CIMWin32.mof

PREVIOUSArchive