Public/Get-Processes.ps1
|
<#
.SYNOPSIS Gets information about the processes running in computer. .DESCRIPTION Gets information about the processes running in computer. .NOTES This function is pulled directly from the real Microsoft Windows Admin Center PowerShell scripts use rights (according to Microsoft): We grant you a non-exclusive, royalty-free right to use, modify, reproduce, and distribute the scripts provided herein. ANY SCRIPTS PROVIDED BY MICROSOFT ARE PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS OR A PARTICULAR PURPOSE. .ROLE Readers .COMPONENT ProcessList_Body .PARAMETER isLocal This parameter is MANDATORY. TODO .EXAMPLE # Open an elevated PowerShell Session, import the module, and - PS C:\Users\zeroadmin> Get-Processes -isLocal $True #> function Get-Processes { param ( [Parameter(Mandatory = $true)] [boolean] $isLocal ) Import-Module CimCmdlets -ErrorAction SilentlyContinue $processes = Get-CimInstance -Namespace root/Microsoft/Windows/ManagementTools -ClassName Msft_MTProcess $powershellProcessList = @{} $powerShellProcesses = Get-Process -ErrorAction SilentlyContinue foreach ($process in $powerShellProcesses) { $powershellProcessList.Add([int]$process.Id, $process) } if ($isLocal) { # critical processes taken from task manager code # https://microsoft.visualstudio.com/_git/os?path=%2Fbase%2Fdiagnosis%2Fpdui%2Fatm%2FApplications.cpp&version=GBofficial%2Frs_fun_flight&_a=contents&line=44&lineStyle=plain&lineEnd=59&lineStartColumn=1&lineEndColumn=3 $criticalProcesses = ( "$($env:windir)\system32\winlogon.exe", "$($env:windir)\system32\wininit.exe", "$($env:windir)\system32\csrss.exe", "$($env:windir)\system32\lsass.exe", "$($env:windir)\system32\smss.exe", "$($env:windir)\system32\services.exe", "$($env:windir)\system32\taskeng.exe", "$($env:windir)\system32\taskhost.exe", "$($env:windir)\system32\dwm.exe", "$($env:windir)\system32\conhost.exe", "$($env:windir)\system32\svchost.exe", "$($env:windir)\system32\sihost.exe", "$($env:ProgramFiles)\Windows Defender\msmpeng.exe", "$($env:ProgramFiles)\Windows Defender\nissrv.exe", "$($env:ProgramFiles)\Windows Defender\nissrv.exe", "$($env:windir)\explorer.exe" ) $sidebarPath = "$($end:ProgramFiles)\Windows Sidebar\sidebar.exe" $appFrameHostPath = "$($env:windir)\system32\ApplicationFrameHost.exe" $edgeProcesses = ( "$($env:windir)\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe", "$($env:windir)\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe", "$($env:windir)\system32\browser_broker.exe" ) foreach ($process in $processes) { if ($powershellProcessList.ContainsKey([int]$process.ProcessId)) { $psProcess = $powershellProcessList.Get_Item([int]$process.ProcessId) $hasChildWindow = $psProcess -ne $null -and $psProcess.MainWindowHandle -ne 0 $process | Add-Member -MemberType NoteProperty -Name "HasChildWindow" -Value $hasChildWindow if ($psProcess.MainModule -and $psProcess.MainModule.FileVersionInfo) { $process | Add-Member -MemberType NoteProperty -Name "FileDescription" -Value $psProcess.MainModule.FileVersionInfo.FileDescription } } if ($edgeProcesses -contains $nativeProcess.executablePath) { # special handling for microsoft edge used by task manager # group all edge processes into applications $edgeLabel = 'Microsoft Edge' if ($process.fileDescription) { $process.fileDescription = $edgeLabel } else { $process | Add-Member -MemberType NoteProperty -Name "FileDescription" -Value $edgeLabel } $processType = 'application' } elseif ($criticalProcesses -contains $nativeProcess.executablePath ` -or (($nativeProcess.executablePath -eq $null -or $nativeProcess.executablePath -eq '') -and $null -ne ($criticalProcesses | ? {$_ -match $nativeProcess.name})) ) { # process is windows if its executable path is a critical process, defined by Task Manager # if the process has no executable path recorded, fallback to use the name to match to critical process $processType = 'windows' } elseif (($nativeProcess.hasChildWindow -and $nativeProcess.executablePath -ne $appFrameHostPath) -or $nativeProcess.executablePath -eq $sidebarPath) { # sidebar.exe, or has child window (excluding ApplicationFrameHost.exe) $processType = 'application' } else { $processType = 'background' } $process | Add-Member -MemberType NoteProperty -Name "ProcessType" -Value $processType } } $processes } |