After installing KB4343898 (Monthly Rollup August 2018) on Windows 2012 R2 you cannot see the execution path of a non user process anymore

G

gizmo9912

it seems that the spectre part of this patch prevents now, that you can see the full execution path of system processes.

E.g. when I execute in powershell : get-wmiobject win32_process | select *

the values for CommandLine and for ExecutablePath are empty now.

Only when the process is a user process you can stil see this values.

I know that this is a part to secure the server against the spectre vulnerability, but as I use WMI to monitor the processes on windows servers it would be great when you could still get these values when you give special rights to a user or when you use an administrator account.

Has someone found a way to get these values with the patch installed?

Continue reading...
 
Back
Top Bottom