Help solving this WMI problem

This topic contains 7 replies, has 5 voices, and was last updated by  Ivan 1 year ago.

  • Author
  • #72544


    Hi All,

    I'm trying to get the currently logged in user and logon time, and I'm doing it like this:

    $User = (Get-WmiObject -Class Win32_Process -ComputerName $ComputerName| Where-Object Name -Match Explorer).GetOwner().User
    $Time = (Get-WmiObject -Class Win32_Process -ComputerName $ComputerName| Where-Object Name -Match Explorer).CreationDate

    I know I will get yelled at for the noobiness shown in this code but I just fell in love with PowerShell and I'm writing as much code as possible, but anyway, I need a more elegant way to do it since there's a chance that more than 1 user is logged in, so, I need to match the User and Log in time.

    Any enlightenment will be greatly appreciated

  • #72545

    Frank Tucker

    something like this...

    $ComputerName = $env:COMPUTERNAME
    $explorer = (get-wmiobject -Class win32_process -ComputerName $computername | Where-Object name -Match explorer)
    foreach ( $e in $explorer){      
        $properties = @{computername = $ComputerName
                            user = ($e.getowner().user)
                            time = ($e.creationdate)
         $obj = New-Object -TypeName psobject -Property $properties
         Write-Output $obj
  • #72548

    Ben Camareno

    Hey mate,

    From PowerShell v4 you can add the IncludeUserName switch, so you should be able to get what you're looking for like this:

     Get-Process explorer -IncludeUserName | select UserName,StartTime 

    If you need to run it remotely, you should be able to wrap it in an Invoke-Command Scriptblock.
    Hope this helps.

  • #72550

    Chris Bakker

    This should work to:
    Get the name and session's id from:

    Get-WmiObject Win32_LoggedOnUser

    The the time from:

    Get-WmiObject Win32_Logonsession

  • #72562


    Gentlemen, I tip my hat to you.

    Thank you.

  • #72563


    In case some other noob needs a code like this I'm posting my version below (which is Frank's code with a little modification for date formatting)

    $ComputerName = $env:COMPUTERNAME
    $Explorer = (Get-WmiObject -Class Win32_Process -ComputerName $ComputerName | Where-Object Name -Match Explorer)
    ForEach ($User In $Explorer) {      
             $Properties = @{ComputerName = $ComputerName
                             User = ($User.Getowner().User)
                             Time = [System.Management.ManagementDateTimeConverter]::ToDateTime($User.CreationDate) 
             $OutputObj = New-Object -TypeName PSObject -Property $Properties
             Write-Output $OutputObj

    Thanks again guys.

  • #72631

    Richard Siddaway

    If you want to use the CIM cmdlets which are the preferred solution try this

    $ComputerName = $env:COMPUTERNAME
    Get-CimInstance -ClassName Win32_Process -ComputerName $ComputerName -Filter "Name = 'explorer.exe'" | 
    foreach {
       $lguser = Invoke-CimMethod -InputObject $psitem -MethodName GetOwner
       $Properties = @{
          ComputerName = $ComputerName
          User = $lguser.User
          Domain = $lguser.Domain
          Time = $User.CreationDate 
       New-Object -TypeName PSObject -Property $Properties

    You have to use Invoke-CimMethod to get the process owner (I've also added the domain). Getting the date is easier because the CIM cmdlets perform the date formatting

  • #72692


    Hi Richard,

    I will try that, however, in my environment CIM doesn't seems to work.

    But I appreciate the code.

You must be logged in to reply to this topic.