Handy to know:

Start an application

wmic process call create "calc.exe"

Terminate an application

wmic process where name="calc.exe" call terminate

You can also do this remotely

WMIC /NODE:Machine Name /User:UserName /Password:Password process call create "calc.exe"

Drop /Password off the command line to be prompted.

You'll get the following appear if it's successful:

Executing (Win32_Process)->Create()

Method execution successful.

Out Parameters:

instance of __PARAMETERS


ProcessId = 22080;

ReturnValue = 0;


Something I noticed is that it creates the process but it's not interactive. The process is running on the target but not in the current users session. So even though CALC is now running on the remote machine, you cannot interact with it. This is ok for stuff that runs silent, but how do you get processes to run and become visible to the logged on user when using WMIC Process Call Create?