Powershell: Get all suspended tasks

Question

I am trying to get all the suspended tasks from a terminal server running windows server 2012.

I have tried using powershell with wmi object like so:

Get-WmiObject -Class Win32_Process -ComputerName computername -Property status

But the status property of all the processes is empty, yet it shows up in the details view of the task manager like so:

I have also tried the following code to try and get the status of the running threads:

$processes = Get-Process * -ComputerName ppivts | select name,threads

foreach ($process in $processes)
{
   foreach ($thread in $process.Threads)
   {
       if($thread.ThreadState -ne "Wait"){
           $process.Name
           $thread.ThreadState
       }
   }

}

This does not work either. How do I get the status of the process and more specifically the suspended ones?

Answer 1

You could improve the latter code snippet as follows:

$processes = Get-Process *
$processHt = @{}                                 # empty hash table
foreach ($process in $processes) {
  foreach ($thread in $process.Threads) {   
    if($thread.ThreadState -eq "Wait") {
      if ( $processHt.Containskey( $process.Name ) ) {
        if ( $processHt[$process.Name] -match $($thread.WaitReason.ToString()) ) {
        } else {
          $processHt[$process.Name] += ",$($thread.WaitReason.ToString())"
        }
      } else {
        $processHt.Add( $process.Name , $thread.WaitReason.ToString() )
      }
    }
  }
}

"`n=== all threads suspended ==="
$processHt.Keys | Where-Object { $processHt[$_] -eq 'Suspended' }
"`n=== some thread suspended ==="
$processHt.Keys | Where-Object { $processHt[$_] -match 'Suspended' } | 
  ForEach-Object { @{ $_ = $processHt[$_] } } |
  Format-Table -AutoSize -HideTableHeaders       # merely for simple output look 

Sample output:

PS D:\PShell> D:\PShell\SO\46546587.ps1

=== all threads suspended ===
WWAHost

=== some thread suspended ===

System   FreePage,Executive,EventPairLow,Suspended,VirtualMemory,LpcReceive,ExecutionDelay
WWAHost  Suspended                                                                        
explorer UserRequest,Executive,EventPairLow,Suspended                                     



PS D:\PShell> 

Corresponding Task Manager screenshot: