Skip to content

Instantly share code, notes, and snippets.

Forked from atifaziz/Get-ProcessTree.ps1
Last active February 3, 2022 10:18
Show Gist options
  • Star 3 You must be signed in to star a gist
  • Fork 2 You must be signed in to fork a gist
  • Save JPMinty/f4d60adafdfbc12b0e4226a27bf1dcb0 to your computer and use it in GitHub Desktop.
Save JPMinty/f4d60adafdfbc12b0e4226a27bf1dcb0 to your computer and use it in GitHub Desktop.
PowerShell 2.0 script to get processes tree
# Modified to include support for CommandLine, File Hashes, File Paths, Signing Certificates
# Copyright (c) 2020 Jai Minton. All rights reserved.
# Copyright (c) 2014 Atif Aziz. All rights reserved.
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# See the License for the specific language governing permissions and
# limitations under the License.
# Adapted from
function Get-ProcessTree
param([string]$ComputerName, [int]$IndentSize = 2)
$indentSize = [Math]::Max(1, [Math]::Min(12, $indentSize))
$computerName = ($computerName, ".")[[String]::IsNullOrEmpty($computerName)]
$processes = Get-WmiObject Win32_Process -ComputerName $computerName
$pids = $processes | select -ExpandProperty ProcessId
$parents = $processes | select -ExpandProperty ParentProcessId -Unique
$liveParents = $parents | ? { $pids -contains $_ }
$deadParents = Compare-Object -ReferenceObject $parents -DifferenceObject $liveParents `
| select -ExpandProperty InputObject
$processByParent = $processes | Group-Object -AsHashTable ParentProcessId
function Write-ProcessTree($process, [int]$level = 0)
$id = $process.ProcessId
$processCommandLine = $process.CommandLine
$parentProcessId = $process.ParentProcessId
$process = Get-Process -Id $id -ComputerName $computerName
$hash = ($process | gi -ea SilentlyContinue|filehash -ea 0).hash
$signingstatus = ($process | gi -ea SilentlyContinue|authenticodesignature -ea 0).status
$indent = New-Object String(' ', ($level * $indentSize))
$process `
| Add-Member NoteProperty CommandLine $processCommandLine -PassThru `
| Add-Member NoteProperty ParentId $parentProcessId -PassThru `
| Add-Member NoteProperty Level $level -PassThru `
| Add-Member NoteProperty Hash $hash -PassThru `
| Add-Member NoteProperty signature $signingstatus -PassThru `
| Add-Member NoteProperty IndentedName "$indent$($process.Name)" -PassThru
$processByParent.Item($id) `
| ? { $_ } `
| % { Write-ProcessTree $_ ($level + 1) }
$processes `
| ? { $_.ProcessId -ne 0 -and ($_.ProcessId -eq $_.ParentProcessId -or $deadParents -contains $_.ParentProcessId) } `
| % { Write-ProcessTree $_ }
<# Usage:
import-module .\Get-ProcessTree.ps1
Get-ProcessTree -Verbose | select Id, Level, IndentedName, ParentId
OR for more verbose output:
Get-ProcessTree -Verbose | FT Id, Level, IndentedName,ParentId,Path,Hash,CommandLine -AutoSize
Get-ProcessTree -Verbose | FT Id, Level, IndentedName,ParentId,Hash,CommandLine -AutoSize
Get-ProcessTree -Verbose | FT Id, Level, IndentedName,ParentId,Hash,signature,CommandLine -AutoSize
Copy link

eabase commented Oct 12, 2020

This need to be updated to support 3+ using Get-CimInstance Win32_Process.

Copy link

JPMinty commented Oct 13, 2020

This was originally forked as shown and modified.

It was originally created with PowerShell 2.0 support so used Get-WmiObject Win32_Process as CimInstance didn't supersede until 3+. This still very much works with versions 3+ as it is.

Feel free to modify the below:

Get-WmiObject Win32_Process -ComputerName $computerName

with something like the below. If you want support for a remote host to be specified though it will need to be modified further.

Get-CimInstance -ClassName Win32_Process

Copy link

eabase commented Oct 13, 2020

Hi JP,
Great! That pretty much works. Look very nice!
However, for some reason csrss.exe, audiodg.exe, and services.exe are not showing the Paths. Any idea why?
PS. Get-WmiObject is deprecated.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment