Powershell script for killing hanging child processes

This page has been adapted from some internal notes which has had company senstive information stripped.

Introduction

This guide came about due to an issue we had were Puppet on Windows machines would stop reporting to the Puppetmaster. It turned out this was due to a Puppet run that was waiting for a hanging child process to finish.

In our case, it is almost always a Powershell process being run by Puppet that was hanging.

Killing the offending Powershell process is usually all that’s required to get the run to complete. Unfortunately, there's no native graphical way of separating the Powershell processes that are running under Puppet vs other Powershell processes. (I have used SysInternals Process Explorer to do this task, but it’s not installed on the machines by default)

So, I’ve written a Powershell script (taste the irony?) to sniff out Powershell processes running under an active Puppet run and kill them. This script doesn't fix the issue, but merely mitigates it to allow the Puppet run to finish.

Using the script

# Defining the Get-ChildProcesses to find running processes under Puppet
function Get-ChildProcesses ($ParentProcessId) {
    $filter = "parentprocessid = '$($ParentProcessId)'"
    Get-CIMInstance -ClassName win32_process -filter $filter | Foreach-Object {
            $_
            if ($_.ParentProcessId -ne $_.ProcessId) {
                Get-ChildProcesses $_.ProcessId
            }
        }
}

# Find all Ruby processes that are Puppet agents running and get the PID of any Powershell processes that are running
$objects = Get-CimInstance Win32_Process -Filter "name = 'ruby.exe'" |
  Where-Object CommandLine -match "agent --onetime" |
  ForEach-Object {Get-ChildProcesses $_.ProcessId} |
  Where-Object {$_.Name -eq "powershell.exe"}

# Kill the Powershell processes using Get-WmiObject because Stop-Process doesn't work even with the -kill flag
foreach($p in $objects.ProcessId) {
  (get-wmiobject -Class Win32_Process -Filter "ProcessId = $p").Terminate()
}

Obviously, this script was written for a specific purpose. But it can be easily modified to suit your needs. It could even be expanded to take variables.

DISCLAIMER: The information provided on this website is generated from my own notes and is provided "as is" and without warranties. Robert Ian Hawdon can not be held responsible for damages caused by following a guide published on this site. This website contains links to other third-party websites. Such links are provided as convienice of the reader. I do not endorce the contents of these third party sites.

The Chalkboard

Robert Hawdon's Knowledge Base

Powershell script for killing hanging child processes

Introduction

Using the script