Forum Discussion
Ankit0106
Mar 17, 2020Copper Contributor
Get-process does not enumerate all procesess, get error permission denied even when run as admin
There are some process modules that I am getting error for, like permission denied and cannot enumerate for processes like Services, Idle, csrss. It appears there are processes whose modules fundamentally cannot be enumerated due to lack of permissions, even when running with elevation (as admin). How and what permission need to be obtained to be able to enumerate these processes.
Cmdlet executed: Invoke-Command -Session $session -ScriptBlock { Get-Process -Module } and for local just Get-Process -Module
Excerpts of Errors Encountered:
Cannot enumerate the modules of the "services" process.+ CategoryInfo : PermissionDenied: (System.Diagnostics.Process (services):Process) [Get-Process], ProcessCommandException+ FullyQualifiedErrorId : CouldnotEnumerateModules,Microsoft.PowerShell.Comands.GetProcessCommand + PSComputerName
Select-Object : Exception getting "Modules": "Access is denied"
t-Process | Select-Object -ExpandProperty Modules -outvariable proces . + CategoryInfo : InvalidResult: (System.Diagnostics.Process (csrss):PSObject) [Select-Object], GetValueInvocationException + FullyQualifiedErrorId : PropertyEvaluationExpand,Microsoft.PowerShell.Commands.SelectObjectCommand
Cmdlet executed: Invoke-Command -Session $session -ScriptBlock { Get-Process -Module } and for local just Get-Process -Module
Excerpts of Errors Encountered:
Cannot enumerate the modules of the "services" process.+ CategoryInfo : PermissionDenied: (System.Diagnostics.Process (services):Process) [Get-Process], ProcessCommandException+ FullyQualifiedErrorId : CouldnotEnumerateModules,Microsoft.PowerShell.Comands.GetProcessCommand + PSComputerName
Select-Object : Exception getting "Modules": "Access is denied"
t-Process | Select-Object -ExpandProperty Modules -outvariable proces . + CategoryInfo : InvalidResult: (System.Diagnostics.Process (csrss):PSObject) [Select-Object], GetValueInvocationException + FullyQualifiedErrorId : PropertyEvaluationExpand,Microsoft.PowerShell.Commands.SelectObjectCommand
No RepliesBe the first to reply