Newer version of Remove-BadWinlogonProcess but it uses CIM instead, and also checks for hung fontdrvhost.exe processes

Remove-BadWinlogon_CIM.ps1

function Remove-BadWinLogon_CIM {
    <#
        .DESCRIPTION
            This function examines the list of winlogon process and compares them to active sessions.
            If a winlogon process belongs to an active session, it is left alone.  If it is not tied
            to an active session, it is removed.  The console session is specifically ignored, since it
            always has a winlogon process, even though there may not be someone logged into the physical
            console of the machine.

        .SYNOPSIS
            This function removes winlogon processes for dead sessions.

        .PARAMETER ComputerName
            This is the list of computers to check for bad processes

        .NOTES
            The script uses CIM and accesses both the Citrix and CIMV2 namespaces.

        .INPUTS
            [string]
        .OUTPUTS
            None
    #>

    [cmdletbinding()]
    param(
        [parameter(ValueFromPipelineByPropertyName)]
        [string[]]$ComputerName = $env:ComputerName
    )

    foreach ($Computer in $ComputerName) {
        Write-Verbose -Message ('Processing ({0})' -f $Computer)

        $CitrixSessionSplat = @{
            ComputerName       = $ComputerName
            NameSpace          = 'Root\Citrix\hdx'
            ClassName          = 'Citrix_Sessions'
        }
        $CitrixSessionIDList   = (Get-CimInstance @CitrixSessionSplat).SessionID

        $WinLogonSplat = @{
            ComputerName       = $ComputerName
            ClassName          = 'Win32_Process'
            Filter             = "Caption = 'winlogon.exe' OR Caption = 'fontdrvhost.exe' AND SessionID > 1"
        }
        $WinLogonList          = Get-CimInstance @WinLogonSplat

        foreach ($SessionID in $WinLogonList.SessionID) {

            $thisSession = $WinLogonList | Where-Object SessionID -eq $SessionID

            if ($CitrixSessionIDList -Contains $SessionID) {
                $Message = 'This session ({0}) is a LIVE session; the processID is ({1})' -f $thisSession.SessionId, $thisSession.ProcessId
            }
            else {
                $Message = 'This session ({0}) is a DEAD session; the processID is ({1}); stopping this process' -f $thisSession.SessionId, $thisSession.ProcessId
                $thisSession | Remove-CimInstance
            }
            Write-Verbose -Message $Message -Verbose
        }
    }
}