Powershell & Unresponsive Remote Sessions

The other day I started a remote powershell session with Invoke-Command and my script ran…
and ran…
and ran…
I finally tired of waiting, so I decided that I’d RDP in and get the information via. GUI, but the server was sluggish. This isn’t an underspec’ed server where routine use might cause a small but noticable performance hit. I took a look at taskman and saw that the wsmprovhost.exe process was consuming 50/64GB RAM.

It turns out that this is the process responsible for remote Powershell sessions. While I could just kill it, I wanted to see what is going on behind the scenes.

First, I grabbed the URI for WSMan connections:

PS C:\> $URI = ('http://{0}:5985/wsman' -f $env:computername); $URI

http://SERVER:5985/wsman

Then, I listed the connections to that URI. I could have filtered on the sessions owned by my user ID to avoid impacting others who might have active sessions, but I’m the only IT staff who uses Powershell, so that’s unnecessary:

PS C:\> $connection = Get-WSManInstance -ConnectionURI $URI -ResourceURI shell -Enumerate; $connection

rsp             : http://schemas.microsoft.com/wbem/wsman/1/windows/shell
lang            : en-US
ShellId         : 4C1DF700-45AE-4322-8FAC-E4E688F3F52C
Name            : Runspace10
ResourceUri     : http://schemas.microsoft.com/powershell/Microsoft.PowerShell
Owner           : DOMAIN\USERNAME
ClientIP        : 192.168.0.1
ProcessId       : 20956
IdleTimeOut     : PT7200.000S
InputStreams    : stdin pr
OutputStreams   : stdout
MaxIdleTimeOut  : PT2147483.647S
Locale          : en-US
DataLocale      : en-US
CompressionMode : XpressCompression
ProfileLoaded   : Yes
Encoding        : UTF8
BufferMode      : Block
State           : Connected
ShellRunTime    : P3DT2H43M28S
ShellInactivity : P0DT0H1M21S
MemoryUsed      : 6MB
ChildProcesses  : 0

rsp             : http://schemas.microsoft.com/wbem/wsman/1/windows/shell
lang            : en-US
ShellId         : 3A169BBF-C590-4D36-A055-88ED9B9F741C
Name            : Runspace24
ResourceUri     : http://schemas.microsoft.com/powershell/Microsoft.PowerShell
Owner           : DOMAIN\USERNAME
ClientIP        : 192.168.0.1
ProcessId       : 18776
IdleTimeOut     : PT7200.000S
InputStreams    : stdin pr
OutputStreams   : stdout
MaxIdleTimeOut  : PT2147483.647S
Locale          : en-US
DataLocale      : en-US
CompressionMode : XpressCompression
ProfileLoaded   : Yes
Encoding        : UTF8
BufferMode      : Block
State           : Connected
ShellRunTime    : P0DT15H38M57S
ShellInactivity : P0DT0H0M27S
MemoryUsed      : 48818MB
ChildProcesses  : 0

rsp             : http://schemas.microsoft.com/wbem/wsman/1/windows/shell
lang            : en-US
ShellId         : 337E488F-5385-485B-A74B-DDF5FB76AEF5
Name            : Runspace17
ResourceUri     : http://schemas.microsoft.com/powershell/Microsoft.PowerShell
Owner           : DOMAIN\USERNAME
ClientIP        : 192.168.0.1
ProcessId       : 11288
IdleTimeOut     : PT7200.000S
InputStreams    : stdin pr
OutputStreams   : stdout
MaxIdleTimeOut  : PT2147483.647S
Locale          : en-US
DataLocale      : en-US
CompressionMode : XpressCompression
ProfileLoaded   : Yes
Encoding        : UTF8
BufferMode      : Block
State           : Connected
ShellRunTime    : P3DT0H19M58S
ShellInactivity : P0DT0H1M49S
MemoryUsed      : 12MB
ChildProcesses  : 0

Bingo! There’s the session consuming 48818MB of RAM. I don’t recall what my other sessions are for, so I’ll just kill them all.

$connection | ForEach-Object {
    Remove-WSManInstance -ConnectionURI $URI shell @{ShellID=$_.ShellID}
}

After a few seconds, taskman showed that the wsmprovhost.exe process was rapidly releasing RAM:
50GB…
37GB…
24GB…
12GB…
process ended.

And with that, the server was back to being its usual snappy self.