Now just like the Get‑CimInstance,
Invoke‑CimMethod is another PowerShell cmdlet used to
invoke the method of the CIM class.
Where the CimInstance is more about retrieving information in the system,
you can use the Invoke‑CimMethod to run queries and actions built into it.
So looking at some of the scripts we had opened previously,
one of them that we ran through was this process script.
In here, when we ran it, if you recall, we had all sorts of processes,
but we weren't able to tie back who is the logged‑in user or
who is the user that owns this process.
So if I comment that out and I uncomment this portion of the script out,
in here we're going to look at specifically the powershell.exe file.
So I want to see the PowerShell process,
and in here, I'm going to send that process over to the Invoke‑CimMethod,
and I'm going to say pull back who, with the MethodName,
pull back who is the owner, and then I'm going to display the PID,
the Owner, and then all the DLLs,
so all the supporting DLLs of those PowerShell processes.
So when I run this, you're going to see it scroll again,
but then when I scroll back up here a little bit,
you're going to see I have the powershell.exe,
which PID it is, and then the Owner.
This is my name, my user account, and then all the supporting DLLs.
Now there was a couple different PowerShell processes running,
so we're going to see a couple of them in here.
We got powershell again with a different PID,
same user, and all the supporting DLLs.
Over in the Services script, if you recall,
we were looking at if the defender was running as a service,
but then we also had in here portions of the script talking about
wanting to look at if our Windows updates were running.
And when we look at it to see if our Windows updates are running,
right now it's showing as Stopped.
If I want to kick that off manually,
I can invoke the method to start the service.
So I can send the service, which is the Windows update service,
the wuauserv,
I can send that over to the Invoke‑CimMethod with the StartService called out,
and now when I run it, I'll check it once,
I'll run it again, I'll check it again, and it'll show that it Started.
So if I comment all this out, one other thing I want to show you in here,
we have a nice cleaner way with a more defined script,
so where it's going to go out, it's going to call that service,
it's going to see if it's running.
If it's not running, it's going to go ahead and start it.
So let me run this now.
You're going to see that WS was stopped.
It's going to start the service.
It's waiting 10 seconds here, so we're going to wait 10 seconds,
and in a few seconds here,
we're going to see that it was Started and now it's Running.
All right, finally, one last thing we want to look at.
So we have some other options.
So if you recall during the trap phase of this course,
we talked about sending updates and different things to reboot the machine.
You can do that with the Invoke‑CimMethod,
there is a method to reboot the machine,
and you can also reboot remote machines if it's set up to allow you to do that.
I'm not going to do that now, but if I were to run this,
it wouldn't reboot the machine, shut it down all nicely.
If we're doing updates, if we're doing different things like starting services,
turning off services,
there's plenty of reasons why we'd want to reboot the machine.
The last thing I'm going to go through, so the Calculator.
I'm going to open that up,
and minimize this a little bit so that we can have some room here.
We're going to bring our Calculator in here.
So what this portion of the script is going to do,
if we uncomment this out, is we're going to grab that Calculator process,
so the CalculatorApp process from our list.
We're then going to say, if it's there,
we want to go ahead and terminate the process,
and then we're going to check to see if it's running again.
So one,
this first item on the list up here is going to pull
back the process with all its details, it's then going to terminate it,
and then it's going to check to see if the process
is still running 3 seconds later.
So I'm going to run this, it's going to check it, it's going to kill it.
You're going to see I have it here, but then it goes away.
This script is good when you need to kill off processes when you have
something running that may potentially be malicious,
unwieldy, locking up the machine.
You can run this query to find that process and kill it.