Hey, dude! What are crap with your Pinvoke.cs? It's fully filled by copypaste code. And if you don't know all sysinternals tools (except GUI which requires additional drivers as Process Monitor and Process Explorer are) can be implemented without CSharp code, only PowerShell.

When installing from Powershell Gallery, the module clobbers with the existing Powershell command "Start-Process", and so the install errors out. Looking at your code, I don't see any function or command called "Start-Process" that differs from the standard Powershell one.

Hi @adamdriscoll,
I'm trying to get nt authority\system processes working over PowerShell remoting. and I came across PoshExec.ps1. It looks to me that Start-RemoteProcess doesn't currently support starting a process as nt authority\system. Is that correct? If so, do you have a general idea of what would be involved to get that working? I'm just trying to get a sense of the scope of that work so I can figure out whether this is a good way to solve my problem.

Thanks for your help,

Alex

Hi All,
I Created a new PowerShell Script project. I'm Getting the error "Attaching the PowerShell Debug Engine debugger to process '{[']} on machine failed." When trying to execute an Empty PowerShell. Any Idea how to fix this?

Hello,
Running into a problem--but it could also just be my limited understanding of these functions. Anyway, I am trying to close (delete) the desktop after using 'New-Desktop' . I have tried numerous different things, but to no avail... Get-Desktop continues to list the created desktop. I even tried this (completely built off your work):

function Close-Desktop
{
    [CmdletBinding()]
    param(
        [Parameter(Mandatory, ValueFromPipeLine=$true, ParameterSetName="Desktop")]
        [PSObject]$Desktop,
        [Parameter(Mandatory, ValueFromPipeLine=$true, ParameterSetName="Name", Position=0)]
        [string]$Name
    )

    Process
    {
        if ($Desktop -eq $null)
        {
            $Desktop = Get-Desktop -Name $Name
        }

        if ($Desktop -eq $null)
        {
            Write-Error "Failed to find desktop"
            return
        }

        if (-not [PoshInternals.User32]::CloseDesktop($Desktop.Handle))
        {
            throw (New-Object System.ComponentModel.Win32Exception)
        }
    }
}

Any ideas on how to destroy the desktop?

Hey man, awesome library, thanks for the effort.

I was trying to use your library in a small utility for renaming directories that have been locked by Visual Studio (not sure why/how this happens), and I ran into an issue when enumerating the handle names for file types. Basically the program would hang when trying to get the handle's property Name. Best I can tell is that it happens on the NtQueryObject call after checking the GrantedAccess value. After some investigation I found that the offending value was 0x1A019F. After adding it to the check it worked like a charm!

Not sure if you are aware what this particular access value represents (from winnt.h it looks like the set bits are WRITE_OWNER, DELETE, FILE_READ_EA, FILE_READ_DATA, and FILE_READ_ATTRIBUTES), but thought I might bring it to your attention. You'll recognize the updated piece of code below.

Again, thanks. This was very useful.

  // Query the object name
  if (_typeStr != null && GrantedAccess != 0x0012019f && GrantedAccess != 0x00120189 && GrantedAccess != 0x120089 && GrantedAccess != 0x1A019F) // dont query some objects that could get stuck
  {
    int length;
    NtDll.NtQueryObject(handleDuplicate, OBJECT_INFORMATION_CLASS.ObjectNameInformation, IntPtr.Zero, 0, out length);
    IntPtr ptr = IntPtr.Zero;
    try
    {
      ptr = Marshal.AllocHGlobal(length);
      if (NtDll.NtQueryObject(handleDuplicate, OBJECT_INFORMATION_CLASS.ObjectNameInformation, ptr, length, out length) != NtStatus.Success)
        return;
      _name = Marshal.PtrToStringUni((IntPtr)((long)ptr + 2 * IntPtr.Size));
      if (_typeStr == "File" || _typeStr == "Directory")
      {
        _name = GetRegularFileNameFromDevice(_name);
      }
    }
    finally
    {
      Marshal.FreeHGlobal(ptr);
    }
  }
}

Hi All,
I Created a new PowerShell Script project. I'm Getting the error "Attaching the PowerShell Debug Engine debugger to process '{[']} on machine failed." When trying to execute an Empty PowerShell. Any Idea how to fix this?