So, I know this is part of #2. However, it seems it doesn't work as intended. I am deploying this with Intune and PSADT, and decided to make a helper script to close processes. This script does a few things
- Only grab processes that are elevated
- Has a list of exclusions and inclusions (kill cmd, but keep msiexec running)
- Checks to see if a process was run interactively by checking the command line argument
- Checks for parent and child processes
- And also uses a process tree (calling notepad from cmd.exe)
It triggers on the event ID that MakeMeAdmin creates and grab sthe SID from it, and kills all of the processes. One of the key points was to ensure legit installables don't get killed. Of course it isn't 100% perfect, but should work. Of course, an .exe can be renamed to setup.exe, even though it could be a game, but at that point, not much we can do.
I'm new to GitHub (as in pulling/pushing), so not sure if a PR is appropriate for this. Since .ps1 scripts are allowed, just rename the extension.
Cleanup-ElevatedProcesses.txt
So, I know this is part of #2. However, it seems it doesn't work as intended. I am deploying this with Intune and PSADT, and decided to make a helper script to close processes. This script does a few things
It triggers on the event ID that MakeMeAdmin creates and grab sthe SID from it, and kills all of the processes. One of the key points was to ensure legit installables don't get killed. Of course it isn't 100% perfect, but should work. Of course, an .exe can be renamed to setup.exe, even though it could be a game, but at that point, not much we can do.
I'm new to GitHub (as in pulling/pushing), so not sure if a PR is appropriate for this. Since .ps1 scripts are allowed, just rename the extension.
Cleanup-ElevatedProcesses.txt