[Alexander Gottwald (ago1024)]

The PR replaces the call to wmic.exe with a call to powershell Get-CimInstance Win32_process.

The output of the script is similar to the old wmic output. CreationDate was omited because it's not used anywhere and the old parsing logic to parse the date does not work with the input from the script.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Alexander Gottwald (ago1024)]

@microsoft-github-policy-service agree

[wenyt (wenytang-ms)]

Please keep this background query independent of user profiles and prevent interactive prompts:

Suggested change

	proc = spawn(powershell, [ '-Command', command ]);
	proc = spawn(powershell, [ '-NoLogo', '-NoProfile', '-NonInteractive', '-Command', command ], { windowsHide: true });

[wenyt (wenytang-ms)]

Please make stdout UTF-8 before decoding it as UTF-8. This keeps already-UTF-8 constrained sessions working and reports a port-attach workaround when policy prevents changing the encoding:

Suggested change

	const command = 'Get-CimInstance Win32_Process | ForEach-Object { "$($_.CommandLine) $($_.ParentProcessId) $($_.ProcessId)" }';
	const command = `
	$ErrorActionPreference = 'Stop'
	if ([Console]::OutputEncoding.CodePage -ne 65001) {
	if ($ExecutionContext.SessionState.LanguageMode -ne 'FullLanguage') {
	throw 'UTF-8 process discovery is restricted by policy. Attach using hostName and port instead.'
	}
	[Console]::OutputEncoding = [System.Text.Encoding]::UTF8
	}
	Get-CimInstance Win32_Process | ForEach-Object { "$($_.CommandLine) $($_.ParentProcessId) $($_.ProcessId)" }
	`;

[wenyt (wenytang-ms)]

Alexander Gottwald (@ago1024) Thanks for submitting the PR! I left two inline suggestions for the PowerShell invocation and output encoding. Please take a look when you have a chance.