11

I have been using PsExec -d to launch console applications in a remote powershell session because I want these apps to run in the background while I perform some task. The problem is that I want the background applications to continue running even if I kill the remote powershell session with Remove-PSSession. What happens currently is once the remote powershell session is killed so are all the processes that were started with the help of PsExec -d. I'm guessing it has something to do with process trees and how windows manages the lifetime of such things.

Does anyone have any idea how I can launch a remote background process and have that process persist even after the remote session is killed?

David K.
  • 6,153
  • 10
  • 47
  • 78

1 Answers1

31

Here is first an explanation of why it works so. Perhaps someone else can use it to bring a another solution.

I edited my answer with solution based on WMI.

When you enter a remote session :

PS C:\Users\JPB> enter-PSSession -ComputerName 192.168.183.100 -Credential $cred
[192.168.183.100]: PS C:\Users\jpb\Documents>

You create on the server a process called wsmprovhost.exe as shown here under

enter image description here

When you simply start a process in this remote session :

[192.168.183.100]: PS C:\Users\jpb\Documents> Start-Process calc.exe

The new process is a child of wsmprovhost.exe as shown here under

enter image description here

If you stop the remote session wsmprovhost.exe disappeared and so the child process.

The explanation is that wsmprovhost.exe and all the processes started by this one belongs to the same job.

enter image description here

By default, on one hand this job DOES NOT supports JOB_OBJECT_LIMIT_BREAKAWAY_OK limit flag that does not allow us to start a process with CREATE_BREAKAWAY_FROM_JOB flag, on the other hand this job supports JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE limit flag that causes all processes associated with the job to terminate when the last handle to the job is closed.

It perhaps exists a solution to configure WinRM to support jobs which supports JOB_OBJECT_LIMIT_BREAKAWAY_OK.

Edited :

So reading Microsoft documentation, I found a documented technical way for you to start a program through WinRM but in an onother job. By default, processes created using CreateProcess by a process associated with a job are associated with the job; however, processes created using Win32_Process.Create are not associated with the job.

So if in you remote session you create a process with WMI like this :

PS C:\silogix> $ps = New-PSSession -ComputerName 192.168.183.100 -Credential $cred
PS C:\silogix> Enter-PSSession -Session $ps
[192.168.183.100]: PS C:\Users\jpb\Documents> Invoke-WmiMethod -path win32_process -name create -argumentlist "calc.exe"



__GENUS          : 2
__CLASS          : __PARAMETERS
__SUPERCLASS     :
__DYNASTY        : __PARAMETERS
__RELPATH        :
__PROPERTY_COUNT : 2
__DERIVATION     : {}
__SERVER         :
__NAMESPACE      :
__PATH           :
ProcessId        : 1236
ReturnValue      : 0

[192.168.183.100]: PS C:\Users\jpb\Documents> exit
PS C:\silogix> Remove-PSSession $ps

If you stop the remote session wsmprovhost.exe disappeared, but the new process stay on the server as show here under :

enter image description here

The processes started with WMI does not belongs to any Job. In french I would say "Ce qu'il fallait démontrer"

JPBlanc
  • 70,406
  • 17
  • 130
  • 175
  • 1
    Thanks for the analysis JPBlanc. My current workaround is to simply use the remote sessions for collecting information that is used to launch processes with `PsExec -d` from outside the remote sessions. This way when the remote session is killed the process started with `PsExec -d` is not. – David K. Jan 03 '12 at 04:13
  • 1
    @davidk01 I think I found a clean solution, I edited my answer to explain it. – JPBlanc Jan 04 '12 at 09:31
  • 1
    Thanks for the great post. It saved me more hours of search how to do this. – Leni Kirilov Nov 15 '12 at 07:00