Home

Get-process does not enumerate all procesess, get error permission denied even when run as admin

%3CLINGO-SUB%20id%3D%22lingo-sub-1233516%22%20slang%3D%22en-US%22%3EGet-process%20does%20not%20enumerate%20all%20procesess%2C%20get%20error%20permission%20denied%20even%20when%20run%20as%20admin%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1233516%22%20slang%3D%22en-US%22%3EThere%20are%20some%20process%20modules%20that%20I%20am%20getting%20error%20for%2C%20like%20permission%20denied%20and%20cannot%20enumerate%20for%20processes%20like%20Services%2C%20Idle%2C%20csrss.%20It%20appears%20there%20are%20processes%20whose%20modules%20fundamentally%20cannot%20be%20enumerated%20due%20to%20lack%20of%20permissions%2C%20even%20when%20running%20with%20elevation%20(as%20admin).%20How%20and%20what%20permission%20need%20to%20be%20obtained%20to%20be%20able%20to%20enumerate%20these%20processes.%3CBR%20%2F%3E%3CBR%20%2F%3ECmdlet%20executed%3A%20Invoke-Command%20-Session%20%24session%20-ScriptBlock%20%7B%20Get-Process%20-Module%20%7D%20and%20for%20local%20just%20Get-Process%20-Module%3CBR%20%2F%3E%3CBR%20%2F%3EExcerpts%20of%20Errors%20Encountered%3A%3CBR%20%2F%3E%3CBR%20%2F%3ECannot%20enumerate%20the%20modules%20of%20the%20%22services%22%20process.%2B%20CategoryInfo%20%3A%20PermissionDenied%3A%20(System.Diagnostics.Process%20(services)%3AProcess)%20%5BGet-Process%5D%2C%20ProcessCommandException%2B%20FullyQualifiedErrorId%20%3A%20CouldnotEnumerateModules%2CMicrosoft.PowerShell.Comands.GetProcessCommand%20%2B%20PSComputerName%3CBR%20%2F%3E%3CBR%20%2F%3ESelect-Object%20%3A%20Exception%20getting%20%22Modules%22%3A%20%22Access%20is%20denied%22%3CBR%20%2F%3E%3CBR%20%2F%3Et-Process%20%7C%20Select-Object%20-ExpandProperty%20Modules%20-outvariable%20proces%20.%20%2B%20CategoryInfo%20%3A%20InvalidResult%3A%20(System.Diagnostics.Process%20(csrss)%3APSObject)%20%5BSelect-Object%5D%2C%20GetValueInvocationException%20%2B%20FullyQualifiedErrorId%20%3A%20PropertyEvaluationExpand%2CMicrosoft.PowerShell.Commands.SelectObjectCommand%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1233516%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3Eenumerate%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EError%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3Eprocess%20id%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EWindows%20PowerShell%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Highlighted
Occasional Visitor
There are some process modules that I am getting error for, like permission denied and cannot enumerate for processes like Services, Idle, csrss. It appears there are processes whose modules fundamentally cannot be enumerated due to lack of permissions, even when running with elevation (as admin). How and what permission need to be obtained to be able to enumerate these processes.

Cmdlet executed: Invoke-Command -Session $session -ScriptBlock { Get-Process -Module } and for local just Get-Process -Module

Excerpts of Errors Encountered:

Cannot enumerate the modules of the "services" process.+ CategoryInfo : PermissionDenied: (System.Diagnostics.Process (services):Process) [Get-Process], ProcessCommandException+ FullyQualifiedErrorId : CouldnotEnumerateModules,Microsoft.PowerShell.Comands.GetProcessCommand + PSComputerName

Select-Object : Exception getting "Modules": "Access is denied"

t-Process | Select-Object -ExpandProperty Modules -outvariable proces . + CategoryInfo : InvalidResult: (System.Diagnostics.Process (csrss):PSObject) [Select-Object], GetValueInvocationException + FullyQualifiedErrorId : PropertyEvaluationExpand,Microsoft.PowerShell.Commands.SelectObjectCommand