Missing glue (find or match?) in a simple script...

jvanabra · 2019-03-07T17:08:32.000Z

Howdy all -

I have two parts of a short script, and am missing a middle part… hoping someone can point me in the right direction.

Part 1 - Queries WMI for all users running a specific process and returns the specific process’s path along with the username.

Get-WmiObject -ComputerName $host win32_process | ? {$_.Name -eq $appname} | Select-Object Path, @{Name="UserName";Expression={$_.GetOwner().User}}

It works great, returning things like:

c:\path1\app.exe user1

c:\path2\app.exe user2

The process name is always the same (“app.exe”) - it’s the path and user that is critical.

Part 2 - ???

Part 3 - Finds the session ID of a user, logs them off.

((quser /server:$host | Where-Object { $_ -match $user }) -split ' +')[3] ; logoff $sid /server:$host

Right now, part 2 is manual since I need to separate people running from PATH1 from PATH2, so I export from Step 1 to a text file, “FIND” the right path, put it into a second text file, then run Step 3 against that text file.

I’m trying to figure out what Step 2 is so that $user is only populated with a username running from PATH1 without having to do the manual bit.

Any help is appreciated!

patrickdeno2 · 2019-03-07T18:18:15.000Z

Give this a shot. I am unable to test this so it may need tweaking. I’m only going off of what I think you want. So, I may be totally off as well.

$Users = Get-WmiObject -ComputerName $host win32_process | ? {$_.Name -eq $appname} | Select-Object Path, @{Name="UserName";Expression={$_.GetOwner().User}}

Foreach ($User in $Users) {

	If (($User.split()[0]) -ieq "c:\path1\app.exe") {

		$User = $User.split()[-1]
		((quser /server:$host | Where-Object { $_ -match $User }) -split ' +')[3] ; logoff $sid /server:$host

	}
	
}