title: Why does Get-WmiObject fail when run remotely via Invoke-Command?
body: <p>I'm attempting to build a simple "get-ProcessInfo.ps1" module to be used with a PowerShell (forensics/IR) framework called Kansa. The command is a simple one liner that calls Get-WMIObject win32_process and pipes it into Select-Object. Then Kansa SHOULD export the data to Csv via the Export-Csv cmdlet. The script runs without issue on my local host, however it fails when run remotely (on windows) via the Invoke-Command cmdlet in Kansa. My error logging shows get-ProcessInfo.ps1 "Cannot find a process with the process identifier ####", for every processID. Other modules run on the remote hosts without issue, so I know I'm authenticating as an admin. Therefore I think I'm running into a permissions error, or possibly an authentication issue with Wmi. I'm running this in a Windows domain, from a Windows box, via a domain admin account.  </p>
  
  <p>Kansa GitHub: <a href="https://github.com/davehull/Kansa" rel="nofollow noreferrer">https://github.com/davehull/Kansa</a>
  Kansa Talk: <a href="https://www.youtube.com/watch?v=cQmsT9D0kKI" rel="nofollow noreferrer">https://www.youtube.com/watch?v=cQmsT9D0kKI</a></p>
  
  <p>I've attempted to replicate the WmiObject call as seen in another Kansa module, but this still did not produce data from remote hosts. - <a href="https://github.com/davehull/Kansa/blob/master/Modules/Process/Get-ProcsWMI.ps1" rel="nofollow noreferrer">https://github.com/davehull/Kansa/blob/master/Modules/Process/Get-ProcsWMI.ps1</a></p>
  
  <p>I attempted to understand what was happening in the InjectedThreads.ps1 script since it uses WmiObject remotely without issue, but its a bit over my head. From what I could understand, it sounds like WmiObject is "unmanaged" (unauthenticated? / not inheriting Kerberos from PowerShell?) - <a href="https://github.com/davehull/Kansa/blob/master/Modules/Process/Get-InjectedThreads.ps1" rel="nofollow noreferrer">https://github.com/davehull/Kansa/blob/master/Modules/Process/Get-InjectedThreads.ps1</a></p>
  
  <p>I've attempted multiple variations of Wmi Authentication, Impersonation and Privileges. Which unfortunately still produces no remote data. - <a href="https://blogs.msmvps.com/richardsiddaway/2011/08/04/authentication-impersonation-and-privileges/" rel="nofollow noreferrer">https://blogs.msmvps.com/richardsiddaway/2011/08/04/authentication-impersonation-and-privileges/</a></p>
  
  <p>Finally, since get-WmiObject is technically deprecated, in favor of Get-CIMInstance, I've attempted multiple variations of the Get-CIMInstance cmdlet. </p>
  
  <p>Here is the code from the module I'm attempting to make, get-ProcessInfo.ps1</p>
  
  <pre><code>Get-WmiObject win32_process | Select-Object creationdate,ws,ProcessName,ProcessID,ParentProcessID, @{Name = 'ParentProcessName';Expression = {(Get-Process -Id $_.ParentProcessId).Name}},Path,CommandLine,@{Name = 'ParentProcessPath';Expression = {(Get-Process -Id $_.ParentProcessId).Path}}
  </code></pre>
  
  <p>Expected results should be a list of processes and their related info, which works on my local machine, and returns no data (just errors) when run remotely via the Invoke-Command within Kansa.ps1</p>
  
  <p>Can someone point me in the proper direction with what exactly is happening here, and how I might go about resolving the issue? </p>
  
  <p>*As a note, this scrip is run via WinRM (Invoke-Command) on a remote host, so asking for credentials is out of the question, and so is hard coded credentials. </p>