processes probe: some processes show empty details in the status tab
Article ID: 261717
Updated On:
Products
Issue/Introduction
We have deployed the processes probe and noticed that some of the processes that are running on the system, appear in the STATUS tab of the probe with missing / blank information.
What is causing this?
Environment
Release : UIM 20.x, Processes probe any version
Cause
Permissions on the processes.
The processes that might not be visible in the Status Tab could be "protected"
Using Microsoft Process Explorer (Microsoft site) and accessing the process properties Security tab you might see that the process is "Protected".
This means that the local user does not have enough permissions on the process to visualize, for example, its correct path.
An alterntative to check wether if the process is secured/protected is to check the following command in powershell:
Not protected: (path is returned)
C:\> ps -Name winlogon | select ProcessName, Path
ProcessName Path
----------- ----
winlogon C:\Windows\system32\winlogon.exe
winlogon C:\Windows\system32\winlogon.exe
Protected (no path is retuned)
C:\> ps -Name process1 select ProcessName, Path
ProcessName Path
----------- ----
process1
process1
process1
If not path is returned, the probe won't be able to monitor this process
Resolution
Provide the correct permissions to the monitored process.
Additional Information
Feedback
