CrowdStrike / falcon-orchestrator

CrowdStrike Falcon Orchestrator provides automated workflow and response capabilities
GNU Affero General Public License v3.0
185 stars 60 forks source link

WinRM process not being closed upon exception/failure (maximum number of concurrent shells) #20

Closed mr-burnse closed 7 years ago

mr-burnse commented 7 years ago

When using the Forensics modules, if a failure occurs the winrm process (wsmprovhost.exe) is not terminated as expected on the remote host. If this occurs 5 times the following error will be presented. The workaround solution is to go an terminate those processes on the remote host. This will be addressed in the next release.

Error! Connecting to remote server failed with the following error message : The WS-Management service cannot process the request. This user is allowed a maximum number of 5 concurrent shells, which has been exceeded. Close existing shells or raise the quota for this user. For more information, see the about_Remote_Troubleshooting Help topic.