Skip to content

Instantly share code, notes, and snippets.

@JPMinty

JPMinty/Get-ProcessTree.ps1

Forked from atifaziz/Get-ProcessTree.ps1
Last active February 3, 2022 10:18
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save JPMinty/f4d60adafdfbc12b0e4226a27bf1dcb0 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save JPMinty/f4d60adafdfbc12b0e4226a27bf1dcb0 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. JPMinty revised this gist Mar 17, 2020. 1 changed file with 2 additions and 0 deletions.
    2 changes: 2 additions & 0 deletions Get-ProcessTree.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -59,6 +59,8 @@ function Get-ProcessTree
    }

    <# Usage:
    import-module .\Get-ProcessTree.ps1
    Get-ProcessTree -Verbose | select Id, Level, IndentedName, ParentId
    OR for more verbose output:
  2. JPMinty revised this gist Mar 17, 2020. 1 changed file with 11 additions and 5 deletions.
    16 changes: 11 additions & 5 deletions Get-ProcessTree.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -1,4 +1,4 @@
    # Modified to include support for CommandLine
    # Modified to include support for CommandLine, File Hashes, File Paths, Signing Certificates
    # Copyright (c) 2020 Jai Minton. All rights reserved.
    # Copyright (c) 2014 Atif Aziz. All rights reserved.
    #
    @@ -36,13 +36,17 @@ function Get-ProcessTree
    {
    $id = $process.ProcessId
    $processCommandLine = $process.CommandLine
    $parentProcessId = $process.ParentProcessId
    $parentProcessId = $process.ParentProcessId
    $process = Get-Process -Id $id -ComputerName $computerName
    $hash = ($process | gi -ea SilentlyContinue|filehash -ea 0).hash
    $signingstatus = ($process | gi -ea SilentlyContinue|authenticodesignature -ea 0).status
    $indent = New-Object String(' ', ($level * $indentSize))
    $process `
    | Add-Member NoteProperty CommandLine $processCommandLine -PassThru `
    | Add-Member NoteProperty ParentId $parentProcessId -PassThru `
    | Add-Member NoteProperty ParentId $parentProcessId -PassThru `
    | Add-Member NoteProperty Level $level -PassThru `
    | Add-Member NoteProperty Hash $hash -PassThru `
    | Add-Member NoteProperty signature $signingstatus -PassThru `
    | Add-Member NoteProperty IndentedName "$indent$($process.Name)" -PassThru
    $processByParent.Item($id) `
    | ? { $_ } `
    @@ -57,7 +61,9 @@ function Get-ProcessTree
    <# Usage:
    Get-ProcessTree -Verbose | select Id, Level, IndentedName, ParentId
    OR
    OR for more verbose output:
    Get-ProcessTree -Verbose | FT Id, Level, IndentedName, ParentId,Path,CommandLine
    Get-ProcessTree -Verbose | FT Id, Level, IndentedName,ParentId,Path,Hash,CommandLine -AutoSize
    Get-ProcessTree -Verbose | FT Id, Level, IndentedName,ParentId,Hash,CommandLine -AutoSize
    Get-ProcessTree -Verbose | FT Id, Level, IndentedName,ParentId,Hash,signature,CommandLine -AutoSize
    #>
  3. JPMinty revised this gist Mar 14, 2020. 1 changed file with 12 additions and 3 deletions.
    15 changes: 12 additions & 3 deletions Get-ProcessTree.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -1,3 +1,5 @@
    # Modified to include support for CommandLine
    # Copyright (c) 2020 Jai Minton. All rights reserved.
    # Copyright (c) 2014 Atif Aziz. All rights reserved.
    #
    # Licensed under the Apache License, Version 2.0 (the "License");
    @@ -14,6 +16,7 @@

    # Adapted from http://p0w3rsh3ll.wordpress.com/2012/10/12/show-processtree/


    function Get-ProcessTree
    {
    [CmdletBinding()]
    @@ -32,11 +35,13 @@ function Get-ProcessTree
    function Write-ProcessTree($process, [int]$level = 0)
    {
    $id = $process.ProcessId
    $parentProcessId = $process.ParentProcessId
    $processCommandLine = $process.CommandLine
    $parentProcessId = $process.ParentProcessId
    $process = Get-Process -Id $id -ComputerName $computerName
    $indent = New-Object String(' ', ($level * $indentSize))
    $process `
    | Add-Member NoteProperty ParentId $parentProcessId -PassThru `
    | Add-Member NoteProperty CommandLine $processCommandLine -PassThru `
    | Add-Member NoteProperty ParentId $parentProcessId -PassThru `
    | Add-Member NoteProperty Level $level -PassThru `
    | Add-Member NoteProperty IndentedName "$indent$($process.Name)" -PassThru
    $processByParent.Item($id) `
    @@ -51,4 +56,8 @@ function Get-ProcessTree

    <# Usage:
    Get-ProcessTree -Verbose | select Id, Level, IndentedName, ParentId
    #>
    OR
    Get-ProcessTree -Verbose | FT Id, Level, IndentedName, ParentId,Path,CommandLine
    #>
  4. @atifaziz atifaziz revised this gist Mar 7, 2014. 1 changed file with 1 addition and 2 deletions.
    3 changes: 1 addition & 2 deletions Get-ProcessTree.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -17,8 +17,7 @@
    function Get-ProcessTree
    {
    [CmdletBinding()]
    param([string]$ComputerName,
    [int]$IndentSize = 2)
    param([string]$ComputerName, [int]$IndentSize = 2)

    $indentSize = [Math]::Max(1, [Math]::Min(12, $indentSize))
    $computerName = ($computerName, ".")[[String]::IsNullOrEmpty($computerName)]
  5. @atifaziz atifaziz revised this gist Mar 7, 2014. 1 changed file with 5 additions and 4 deletions.
    9 changes: 5 additions & 4 deletions Get-ProcessTree.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -28,7 +28,8 @@ function Get-ProcessTree
    $liveParents = $parents | ? { $pids -contains $_ }
    $deadParents = Compare-Object -ReferenceObject $parents -DifferenceObject $liveParents `
    | select -ExpandProperty InputObject

    $processByParent = $processes | Group-Object -AsHashTable ParentProcessId

    function Write-ProcessTree($process, [int]$level = 0)
    {
    $id = $process.ProcessId
    @@ -39,8 +40,8 @@ function Get-ProcessTree
    | Add-Member NoteProperty ParentId $parentProcessId -PassThru `
    | Add-Member NoteProperty Level $level -PassThru `
    | Add-Member NoteProperty IndentedName "$indent$($process.Name)" -PassThru
    $processes `
    | ? { $_.ParentProcessId -eq $id } `
    $processByParent.Item($id) `
    | ? { $_ } `
    | % { Write-ProcessTree $_ ($level + 1) }
    }

    @@ -50,5 +51,5 @@ function Get-ProcessTree
    }

    <# Usage:
    Get-ProcessTree | select Id, Level, IndentedName, ParentId
    Get-ProcessTree -Verbose | select Id, Level, IndentedName, ParentId
    #>
  6. @atifaziz atifaziz revised this gist Mar 7, 2014. 1 changed file with 1 addition and 2 deletions.
    3 changes: 1 addition & 2 deletions Get-ProcessTree.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -35,11 +35,10 @@ function Get-ProcessTree
    $parentProcessId = $process.ParentProcessId
    $process = Get-Process -Id $id -ComputerName $computerName
    $indent = New-Object String(' ', ($level * $indentSize))
    $label = "$indent$($process.Name)"
    $process `
    | Add-Member NoteProperty ParentId $parentProcessId -PassThru `
    | Add-Member NoteProperty Level $level -PassThru `
    | Add-Member NoteProperty IndentedName $label -PassThru
    | Add-Member NoteProperty IndentedName "$indent$($process.Name)" -PassThru
    $processes `
    | ? { $_.ParentProcessId -eq $id } `
    | % { Write-ProcessTree $_ ($level + 1) }
  7. @atifaziz atifaziz revised this gist Mar 6, 2014. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion Get-ProcessTree.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -20,7 +20,7 @@ function Get-ProcessTree
    param([string]$ComputerName,
    [int]$IndentSize = 2)

    $indentSize = [Math]::Max(1, [Math]::Min(12, $indentSize))
    $indentSize = [Math]::Max(1, [Math]::Min(12, $indentSize))
    $computerName = ($computerName, ".")[[String]::IsNullOrEmpty($computerName)]
    $processes = Get-WmiObject Win32_Process -ComputerName $computerName
    $pids = $processes | select -ExpandProperty ProcessId
  8. @atifaziz atifaziz revised this gist Mar 6, 2014. 1 changed file with 1 addition and 0 deletions.
    1 change: 1 addition & 0 deletions Get-ProcessTree.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -20,6 +20,7 @@ function Get-ProcessTree
    param([string]$ComputerName,
    [int]$IndentSize = 2)

    $indentSize = [Math]::Max(1, [Math]::Min(12, $indentSize))
    $computerName = ($computerName, ".")[[String]::IsNullOrEmpty($computerName)]
    $processes = Get-WmiObject Win32_Process -ComputerName $computerName
    $pids = $processes | select -ExpandProperty ProcessId
  9. @atifaziz atifaziz revised this gist Mar 6, 2014. 1 changed file with 8 additions and 7 deletions.
    15 changes: 8 additions & 7 deletions Get-ProcessTree.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -21,11 +21,12 @@ function Get-ProcessTree
    [int]$IndentSize = 2)

    $computerName = ($computerName, ".")[[String]::IsNullOrEmpty($computerName)]
    $processes = Get-WmiObject Win32_Process -ComputerName $computerName
    $pids = $processes | select -ExpandProperty ProcessId
    $parents = $processes | select -ExpandProperty ParentProcessId -Unique
    $liveParents = $parents | ? { $pids -contains $_ }
    $deadParents = Compare-Object -ReferenceObject $parents -DifferenceObject $liveParents | select -ExpandProperty InputObject
    $processes = Get-WmiObject Win32_Process -ComputerName $computerName
    $pids = $processes | select -ExpandProperty ProcessId
    $parents = $processes | select -ExpandProperty ParentProcessId -Unique
    $liveParents = $parents | ? { $pids -contains $_ }
    $deadParents = Compare-Object -ReferenceObject $parents -DifferenceObject $liveParents `
    | select -ExpandProperty InputObject

    function Write-ProcessTree($process, [int]$level = 0)
    {
    @@ -37,7 +38,7 @@ function Get-ProcessTree
    $process `
    | Add-Member NoteProperty ParentId $parentProcessId -PassThru `
    | Add-Member NoteProperty Level $level -PassThru `
    | Add-Member NoteProperty IdentedName $label -PassThru
    | Add-Member NoteProperty IndentedName $label -PassThru
    $processes `
    | ? { $_.ParentProcessId -eq $id } `
    | % { Write-ProcessTree $_ ($level + 1) }
    @@ -49,5 +50,5 @@ function Get-ProcessTree
    }

    <# Usage:
    Get-ProcessTree | select Id, Level, IdentedName, ParentId
    Get-ProcessTree | select Id, Level, IndentedName, ParentId
    #>
  10. @atifaziz atifaziz created this gist Mar 6, 2014.
    53 changes: 53 additions & 0 deletions Get-ProcessTree.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,53 @@
    # Copyright (c) 2014 Atif Aziz. All rights reserved.
    #
    # Licensed under the Apache License, Version 2.0 (the "License");
    # you may not use this file except in compliance with the License.
    # You may obtain a copy of the License at
    #
    # http://www.apache.org/licenses/LICENSE-2.0
    #
    # Unless required by applicable law or agreed to in writing, software
    # distributed under the License is distributed on an "AS IS" BASIS,
    # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    # See the License for the specific language governing permissions and
    # limitations under the License.

    # Adapted from http://p0w3rsh3ll.wordpress.com/2012/10/12/show-processtree/

    function Get-ProcessTree
    {
    [CmdletBinding()]
    param([string]$ComputerName,
    [int]$IndentSize = 2)

    $computerName = ($computerName, ".")[[String]::IsNullOrEmpty($computerName)]
    $processes = Get-WmiObject Win32_Process -ComputerName $computerName
    $pids = $processes | select -ExpandProperty ProcessId
    $parents = $processes | select -ExpandProperty ParentProcessId -Unique
    $liveParents = $parents | ? { $pids -contains $_ }
    $deadParents = Compare-Object -ReferenceObject $parents -DifferenceObject $liveParents | select -ExpandProperty InputObject

    function Write-ProcessTree($process, [int]$level = 0)
    {
    $id = $process.ProcessId
    $parentProcessId = $process.ParentProcessId
    $process = Get-Process -Id $id -ComputerName $computerName
    $indent = New-Object String(' ', ($level * $indentSize))
    $label = "$indent$($process.Name)"
    $process `
    | Add-Member NoteProperty ParentId $parentProcessId -PassThru `
    | Add-Member NoteProperty Level $level -PassThru `
    | Add-Member NoteProperty IdentedName $label -PassThru
    $processes `
    | ? { $_.ParentProcessId -eq $id } `
    | % { Write-ProcessTree $_ ($level + 1) }
    }

    $processes `
    | ? { $_.ProcessId -ne 0 -and ($_.ProcessId -eq $_.ParentProcessId -or $deadParents -contains $_.ParentProcessId) } `
    | % { Write-ProcessTree $_ }
    }

    <# Usage:
    Get-ProcessTree | select Id, Level, IdentedName, ParentId
    #>