>

Find Which File a Running Process Came From

Get the on-disk path of a running process's executable with Get-Process .Path or Win32_Process ExecutablePath.

WindowsProcessessystempowershellLow risk
Run `(Get-Process -Id 1234).Path` (replace 1234 with the PID) or `Get-CimInstance Win32_Process -Filter "ProcessId=1234" | Select-Object Name, ExecutablePath`.

01Command

Command
$ (Get-Process -Id 1234).Path    ::  or:  Get-CimInstance Win32_Process -Filter "ProcessId=1234" | Select-Object Name, ExecutablePath

02What it does

Knowing the folder an executable runs from is the fastest way to judge whether it's legitimate — real Windows binaries live in System32 or Program Files, not Temp or AppData. Get-Process exposes the path via the .Path property of the Process object, while Win32_Process offers ExecutablePath with the same information via CIM.

03Risk

RiskLow risk
RequirementsThe Path property is only readable for processes you have access to; system processes need an elevated (Administrator) prompt.
!Warning: Path may be empty for protected system processes you don't own — rerun the command from an elevated PowerShell prompt.

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

  • Get-Process
    Microsoft Learn · vendor-doc · 2026-09-17
    Evidence: Get-Process returns System.Diagnostics.Process objects whose Path property (documented on the Process class) gives the full path of the executable; cmdlets accept -Id to target a process by PID.
  • Win32_Process class
    Microsoft Learn · vendor-doc · 2026-09-17
    Evidence: Class definition lists the ExecutablePath string property ('the path to the executable file of the process').

Last verified: 2026-09-19 · Category: System & Settings

06Related solutions

Create a scheduled task from CMD with schtasks
WindowsProcessessystemTerminal

Register a recurring Windows task entirely from the command line — ideal for scripts, cleanup jobs, and monitoring probes you want to run unattended.

Medium risk ✓ 2026-09-17
Scan and repair Windows system files with SFC
WindowssystemTerminalDiagnostics

Use the System File Checker to verify every protected Windows system file against known-good copies and automatically replace the damaged ones.

Low risk ✓ 2026-09-17
Install any app from the command line with winget
WindowssystemTerminaldeveloper

Use Windows Package Manager to install, search, and upgrade thousands of applications from the community repository in one command.

Low risk ✓ 2026-09-17