> For the complete documentation index, see [llms.txt](https://otter.gitbook.io/red-teaming/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://otter.gitbook.io/red-teaming/notes/powershell/powershell-snippets/group-processes-by-user-with-wmi.md).

# Group processes by user with WMI

This snippet uses only WMI and CIM cmdlets to list all the processes and group them by the user that started said process.

```powershell
Get-CimInstance -ClassName Win32_Account | ForEach-Object {
    $AccountName = $_.Name

    $AssociatedProcesses = Get-CimAssociatedInstance -InputObject $_ -Association Win32_LoggedOnUser | Get-CimAssociatedInstance -Association Win32_SessionProcess

    # don't list users that don't have associated processes
    if ($AssociatedProcesses) {
        [PSCustomObject] @{ Account = $AccountName; Processes = $AssociatedProcesses }
    }
}
```

References:

* [WMI - Windows Management Instrumentation](/red-teaming/notes/powershell/wmi-windows-management-instrumentation.md)