How I can achive information about which process is handling files/directories? non-standard situation

Łukasz Z 1 Reputation point
2021-02-11T07:58:23.017+00:00

Hello,

here is the idea:
I have a lot of services with name xxx.exe (and diffrent PID of course). Which service have own directory.
Let's say we have 5 services and directories: C:\srv\service1,...., C:\srv\service5
As I mentioned just a second ago the name of the services are the same. I want to know which pid is for the xxx.exe proces handling C:\srv\service1 etc.

What I know for now is that they aren't manipulating on the files and directories directly. I found out that they are creating a child process and that process are create another child process.
So we have something like that per each process:
xxx.exe has the child process yyy.exe. yyy.exe has the child process zzz.exe and this proces is using for file and directory operations.

So at first I must findout PID of the zzz.exe process for particular xxx.exe process. That's the easy part. After this I need to findout a list of files/directories handling by zzz.exe process. Seems that is even more challenging than I thought.

I've read a lot of articles, tried a lot of methods and nothing works. For example a lot of people are using combination of power script with sysinternal handle tools. In my case it's useless. That tool works for most of processes but not for zzz.exe. It shows information that the process could not be opened. If I put the directory path list is empty.

Only one tool has no problem with that - sysinternal process monitor. Unfortunately it's a graphical tool so I can't use this in the script. I am not a powershell expert so I hope that here I can find helpful experts and thay can give me a hint how I can make something similiar as sysinternal process monitor in powershell. Of course I need just part of the functionality. In my case I just want to have a list of handlinf files or directorys for particular process id.

Any ideas?

Windows Server PowerShell
Windows Server PowerShell
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.PowerShell: A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
5,183 questions
{count} votes