forked from PoeBlu/powershell-scripts
-
Notifications
You must be signed in to change notification settings - Fork 1
/
Copy pathKill-process.ps1
65 lines (47 loc) · 2.31 KB
/
Kill-process.ps1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
<#
.SYNOPSIS
Kill process
.DESCRIPTION
This script will kill process by name on a computer(s) on the network. Writes events to an Application event log from "Kill process" source.
.PARAMETER ComputerName
One or more computers to run command against
.PARAMETER ProcessName
Process name to terminate
.EXAMPLE
.\Kill-process.ps1 -ProcessName mspaint.exe
Terminates mspaint.exe process on localhost
.EXAMPLE
.\Kill-process.ps1 -Computername PC01 -ProcessName mspaint.exe
Terminates mspaint.exe process on PC01
.EXAMPLE
.\Kill-process.ps1 -Computername PC01, PC02 -ProcessName mspaint.exe
Terminates mspaint.exe process on PC01 and PC02
#>
[cmdletbinding()]
param(
$ComputerName=$env:COMPUTERNAME,
[parameter(Mandatory=$true)]
$ProcessName
)
$EventSource = [System.Diagnostics.EventLog]::SourceExists("Kill process")
if($EventSource -eq $False){
$newEventSource = New-EventLog -LogName Application -Source "Kill process"
Write-EventLog –LogName Application –Source "Kill process" –EntryType Information –EventID 1 –Message “Created a new event source.”
}
$Processes = Get-WmiObject -Class Win32_Process -ComputerName $ComputerName -Filter "name='$ProcessName'"
if($Processes -eq $null){
Write-EventLog –LogName Application –Source "Kill process" –EntryType Information –EventID 0 –Message “Process $ProcessName does not exits on $ComputerName”
}
foreach ($process in $processes){
$processid = $process.handle
$ownerName = $process.getowner().user
$OwnerDomain= $process.getowner().domain
$compName = $process.pscomputername
$ret = $process.terminate()
if($ret.returnvalue -eq 0){
Write-EventLog –LogName Application –Source "Kill process" –EntryType Information –EventID 0 –Message “Process $ProcessName `($processid`) $OwnerDomain\$ownerName on $compName terminated successfully.”
}
else{
Write-EventLog –LogName Application –Source "Kill process" –EntryType Error –EventID $ret.returnvalue –Message “Process $ProcessName `($processid`) on $compName NOT terminated successfully.”
}
}