{"id":102676,"date":"2024-07-01T14:28:47","date_gmt":"2024-07-01T14:28:47","guid":{"rendered":"https:\/\/www.red-gate.com\/simple-talk\/?p=102676"},"modified":"2026-04-16T09:23:47","modified_gmt":"2026-04-16T09:23:47","slug":"extending-get-process-to-show-the-process-chain-using-powershell-proxy-functions","status":"publish","type":"post","link":"https:\/\/www.red-gate.com\/simple-talk\/sysadmin\/powershell\/extending-get-process-to-show-the-process-chain-using-powershell-proxy-functions\/","title":{"rendered":"PowerShell Proxy Functions: Extend Any Cmdlet Without Modifying It"},"content":{"rendered":"

PowerShell proxy functions (also called wrapper functions) allow you to extend or modify any existing cmdlet without touching its source code. You create a new function with the same name and parameters as the original cmdlet, add your custom logic, and call the original through the proxy. This article demonstrates the technique by extending Get-Process: adding a -ShowChain switch parameter that retrieves the full parent-child process chain for each process using WMI, displaying process relationships that the standard Get-Process output doesn’t provide. The same proxy function pattern applies to any cmdlet you want to extend.<\/strong><\/p>\n

A proxy function or wrapper function allows you to deploy a custom version of a function or cmdlet while the internal functionality remains implemented. That means you can get a core cmdlet or function, add parameters (or remove), and write the code for these parameters, customizing a new version of this core cmdlet or function. Also, we get the begin, process and end block exposed from the PowerShell advanced functions, allowing control over the command steppable pipeline.<\/p>\n

The SteppablePipeline<\/a> allows you to implement a cmdlet (advanced function) by delegating most of the implementation to another cmdlet in a memory-efficient, streaming manner.<\/p>\n

From this stackoverflow post<\/a> by mklement0<\/a>: \u201cSpecifically, a steppable pipeline allows you to delegate the implementation of your proxy function to a script block whose life cycle is kept in sync with the proxy function itself, in terms of initialization (begin block), per-object pipeline input processing (process block), and termination (end block), which means that the single instantiation of the wrapped cmdlet is in effect directly connected to the same pipeline as the proxy function itself.\u201d<\/p>\n

Let\u00b4s create a scenario with SQL Server. If you use xp_cmdshell<\/code> to call the notepad executable, your session will be hanging until you kill the process in the OS, which can be done with Task Manager. Execute the following if you want to try it:<\/p>\n

xp_cmdshell 'NOTEPAD'<\/pre>\n
You will see something similar to:<\/p>\n
\"SQL<\/p>\n
The app will not open a window on your machine, but if you go to task manager you will see it, and you can kill it.<\/p>\n
<\/p>\n
Or, if you want to see the complete chain using Process Explorer<\/a>:<\/p>\n
<\/p>\n
But using PowerShell, Get-Process<\/code>:<\/p>\n
Get-Process<\/pre>\n
It\u00b4s not listed:<\/p>\n
<\/p>\n
It would be fantastic if we could get the process chain in the Get-Process<\/code> return values, so we will add a new parameter called ShowChain<\/code> to Get-Process<\/code> to extend its functionality.<\/p>\n
Note: the final code is very long, and the snippets are available in the article for browsing and understanding the process. You can download the final working code (in a .txt file) from the Simple Talk site here.<\/a><\/em><\/p>\n
FIRST STEP – GET THE METADATA FROM GET-PROCESS<\/h2>\n
The first step is to get the metadata from Get-Process and saved to a file called Get-Process.txt in the temp folder to check how it works:<\/p>\n
$Cmd = Get-Command Get-Process\n$CmdMetadata = New-Object System.Management.Automation.CommandMetaData $Cmd \n[System.Management.Automation.ProxyCommand]::Create($CmdMetadata) | \n     Out-File C:\\temp\\Get-Process.txt   \n\n<\/pre>\n
The output file will be the following:<\/p>\n
[CmdletBinding(DefaultParameterSetName='Name', HelpUri='https:\/\/go.microsoft.com\/fwlink\/?LinkID=113324', RemotingCapability='SupportedByCommand')]\nparam(\n    [Parameter(ParameterSetName='NameWithUserName', Position=0, ValueFromPipelineByPropertyName=$true)]\n    [Parameter(ParameterSetName='Name', Position=0, ValueFromPipelineByPropertyName=$true)]\n    [Alias('ProcessName')]\n    [ValidateNotNullOrEmpty()]\n    [string[]]\n    ${Name},\n    [Parameter(ParameterSetName='IdWithUserName', Mandatory=$true, ValueFromPipelineByPropertyName=$true)]\n    [Parameter(ParameterSetName='Id', Mandatory=$true, ValueFromPipelineByPropertyName=$true)]\n    [Alias('PID')]\n    [int[]]\n    ${Id},\n    [Parameter(ParameterSetName='InputObjectWithUserName', Mandatory=$true, ValueFromPipeline=$true)]\n    [Parameter(ParameterSetName='InputObject', Mandatory=$true, ValueFromPipeline=$true)]\n    [System.Diagnostics.Process[]]\n    ${InputObject},\n    [Parameter(ParameterSetName='NameWithUserName', Mandatory=$true)]\n    [Parameter(ParameterSetName='IdWithUserName', Mandatory=$true)]\n    [Parameter(ParameterSetName='InputObjectWithUserName', Mandatory=$true)]\n    [switch]\n    ${IncludeUserName},\n    [Parameter(ParameterSetName='Id', ValueFromPipelineByPropertyName=$true)]\n    [Parameter(ParameterSetName='Name', ValueFromPipelineByPropertyName=$true)]\n    [Parameter(ParameterSetName='InputObject', ValueFromPipelineByPropertyName=$true)]\n    [Alias('Cn')]\n    [ValidateNotNullOrEmpty()]\n    [string[]]\n    ${ComputerName},\n    [Parameter(ParameterSetName='Id')]\n    [Parameter(ParameterSetName='InputObject')]\n    [Parameter(ParameterSetName='Name')]\n    [ValidateNotNull()]\n    [switch]\n    ${Module},\n    [Parameter(ParameterSetName='InputObject')]\n    [Parameter(ParameterSetName='Id')]\n    [Parameter(ParameterSetName='Name')]\n    [Alias('FV','FVI')]\n    [ValidateNotNull()]\n    [switch]\n    ${FileVersionInfo})\nbegin\n{\n    try {\n        $outBuffer = $null\n        if ($PSBoundParameters.TryGetValue('OutBuffer', [ref]$outBuffer))\n        {\n            $PSBoundParameters['OutBuffer'] = 1\n        }\n        $wrappedCmd = $ExecutionContext.InvokeCommand.GetCommand('Microsoft.PowerShell.Management\\Get-Process', [System.Management.Automation.CommandTypes]::Cmdlet)\n        $scriptCmd = {& $wrappedCmd @PSBoundParameters }\n        $steppablePipeline = $scriptCmd.GetSteppablePipeline($myInvocation.CommandOrigin)\n        $steppablePipeline.Begin($PSCmdlet)\n    } catch {\n        throw\n    }\n}\nprocess\n{\n    try {\n        $steppablePipeline.Process($_)\n    } catch {\n        throw\n    }\n}\nend\n{\n    try {\n        $steppablePipeline.End()\n    } catch {\n        throw\n    }\n}\n<#\n.ForwardHelpTargetName Microsoft.PowerShell.Management\\Get-Process\n.ForwardHelpCategory Cmdlet\n#><\/pre>\n
Using the words of my good friend Shay Levy<\/a> :<\/p>\n
\u201cDon\u2019t get intimidated by the result. This is what a proxy function looks like. As you can see, the generated code starts by including all the cmdlet parameters and then defines the script blocks of the command. At the end, there are instructions for the Get-Help cmdlet.<\/em><\/p>\n
In the Begin block, the Get-Process command ($wrappedCmd) is retrieved, and the parameters are passed to it (@PSBoundParameters). A steppable pipeline is initialized ($steppablePipeline), which invokes the cmdlet ($scriptCmd), and finally, the Begin starts. At the end of the code sample, you can find a multiline comment that is used to instruct the Help that Get-Help should display when you type Get-Help <ProxyFunction>.\u201d<\/em><\/p>\n
In this script, add the following:<\/p>\n
Function  Get-Process {<\/code> } <\/code><\/pre>\n
Our new cmdlet will have the same name of the core cmdlet Get-Process<\/code> . It\u00b4s not a problem as we will see later in this article.\u00a0Now it\u2019s time to create the Function that will retrieve the Process Chain :<\/p>\n
SECOND STEP – CREATE THE PARAMETER<\/h2>\n
The next step is create the switch parameter ShowChain:<\/code><\/p>\n
           [ValidateNotNull()]\n           [switch]\n           ${ShowChain}) \n\n<\/pre>\n
It is inserted the code thusly:<\/p>\n
<\/p>\n
THIRD STEP – CREATE THE FUNCTION WITH THE PROCESS CHAIN.<\/h2>\n
The function gets the ProcesseId<\/code> column from Get-Process<\/code> and query the WMI win32_process<\/code> to get the child process because Get-Process<\/code> does not return the ParentID<\/code> column. Then it creates a loop to find the complete chain showing in the yellow color and with \u2018-\u2018to hierarchical show.<\/p>\n
function Get-ProcessChain {\n    [cmdletbinding()]\n    Param(\n          [Parameter(Position=0, Mandatory=$true, ValueFromPipeline=$true,ValueFromPipelineByPropertyName = $true)] [System.Diagnostics.Process]$ProcessObject\n    )\n    Begin {\n        $DefaultFColor = $Host.UI.RawUI.ForegroundColor\n        $ArrayContains = @()\n    }\n    process { \n        if ($ArrayContains -notcontains  $ProcessObject.ID ) {\n            $ProcessObject\n            if ($ProcessObject.name -ne \u2018services\u2019) {\n                $ComputerName = $ProcessObject.MachineName\n                $Beforecaption = \u2018-\u2018\n                $ProcessMotherID = $ProcessObject.ID\n                do {\n                    $Hasharguments = @{\n                        Filter = \u201cParentProcessId='$($ProcessMotherID)'\u201d\n                        Property = \"ProcessID,Name\"\n                        ErrorAction = \"ProcessID,Name\"\n                        ComputerName = $ComputerName\n                    }\n                    $ProcessChild = Get-WmiObject win32_process @Hasharguments\n                    if ($ProcessChild ) {\n                        $Beforecaption += \u2018-\u2018\n                        $Host.UI.RawUI.ForegroundColor = \u201cYellow\u201d\n                        $ProcessChild | \n                        ForEach-Object {\n                            Get-Process -Id $_.Processid -ComputerName $ComputerName -ErrorAction SilentlyContinue  |  \n                            Add-Member -MemberType NoteProperty  -name ProcessName -Value \u201c$Beforecaption $($_.Name)\u201d -Force -PassThru            \n                            $ProcessMotherID = $_.Processid\n                            $ArrayContains+= $_.Processid\n                        }\n                    } else {    \n                        $Beforecaption = \u2018-\u2018\n                        Break\n                    }     \n                }  while($true)\n             }     \n                 $Host.UI.RawUI.ForegroundColor = $DefaultFColor\n         }     \n    }\n} \n<\/pre>\n
Using the same names<\/h3>\n
The Proxy Function using the same name of the core cmdlet is not a problem because the function takes precedence in the running, also having the same name, we have the capability of the command discovery process. Here\u00b4s the list of precedence :<\/p>\n