Skip to content

Instantly share code, notes, and snippets.

@figueroadavid
Created May 18, 2023 19:38
Show Gist options
  • Select an option

  • Save figueroadavid/847de2838105d415d3e29b0bacc8bfa7 to your computer and use it in GitHub Desktop.

Select an option

Save figueroadavid/847de2838105d415d3e29b0bacc8bfa7 to your computer and use it in GitHub Desktop.
Kills sessions hung on winlogon.exe; first attempt that uses the command line utilities; works pretty well.
function Remove-BadWinlogonProcess {
[cmdletbinding(SupportsShouldProcess)]
param(
[parameter(Mandatory, ValueFromPipelineByPropertyName)]
[string]$ServerName
)
$DiscSessionWithNoName_RegEx = '^\s+(?<ID>\d+)\s+Disc'
$Winlogon_RegEx = '^ system\s+\d+\s+(?<PID>\d+)\s+winlogon'
qwinsta /server:$ServerName | where-object { $_ -match $DiscSessionWithNoName_RegEx } |
ForEach-Object {
$thisID = $Matches.ID
Write-Verbose -Message ('Checking session {0} on server {1}' -f $thisID, $ServerName)
if ($thisID -gt 1) {
qprocess /id:$thisID /server:$ServerName |
findstr /i winlogon |
Where-Object { $_ -match $Winlogon_RegEx } |
foreach-object {
if ($PSCmdlet.ShouldProcess(('Killing off process ID ({0}) on server {1}' -f $Matches.PID, $ServerName), '', '')) {
tskill $Matches.PID /server:$servername
}
}
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment