Search code examples
powershellwmic

WMIC Query on Creationdate to find old processes

I'm trying to pull information on processes that started more than 1 day ago on my Windows 10 PC. I am having no success matching on the Creationdate field.

wmic process where "Creationdate < $((Get-Date).AddDays(-1).ToShortDateString().toString())" get processid

ERROR: Description = Invalid query

wmic process where "Creationdate < 20200906012615" get processid

ERROR: Description = Invalid query

I do need to use WMIC, if possible.

UPDATED

An example of the full query I need:

WMIC PROCESS WHERE "commandline LIKE '%_900\`"%' AND commandline LIKE '%data-dir%' AND Creationdate < 20200906012615" CALL TERMINATE

Solution

  • I would do it in powershell like this, and I think it's the easiest way. Get-ciminstance actually outputs datetime objects for creationdate, unlike get-wmiobject. "Process" in wmic is an alias for the win32_process class.

    get-ciminstance win32_process | 
  where { $_.creationdate -lt (get-date).AddDays(-1) -and 
  $_.commandline -like '*svchost*' } | 
  remove-ciminstance -whatif