www.nordal-lund.dk

Release your inner geek

Stop Windows processes remotely

Posted on 28 March 2018 by Kasper Lund

Some customer called saying that they couldn’t log in to a certain Windows box. vMware told me the VM was using 100% CPU, and it was to busy doing something to let users log in.
Powershell saved the day (or at least saved the VM from beeing reset)
To find the process running wild I used the invoke-command cmdlet, like this:

invoke-command -scriptblok(get-process | sort-property CPU -Descending | select -first 10) -computername “Windows Hostname” | ft -autosize

This gave me a nice list of processes with the one we should focus on in the top. Now all i needed to do was:

invoke-command -scriptblok(stop-process -Id “pid”) -computername “Windows Hostname”

The process was stopped, and CPU usage fell to 0-2% allowing application people to login and investigate what happened.

Check for open outgoing ports

Posted on 28 March 2018 by Kasper Lund

Want to know which ports are allowed (or open) to use in your organization?
You can check all ports with http://portquiz.net/
In bash somthing like this would help you get going:

for i in `seq 1024 65535`; do if nc -z portquiz.net $i; then echo “Port $i Success”; :; fi done

You will now get a fine list of outgoing ports that are open. Remember that just because some port is open, it doesn’t necessarily mean that it is allowed to use it!