Configure remedial actions - End Process

Configure the End Process remedial action for Microsoft Endpoint Configuration Manager for Investigation (MECM).

Before you begin

Role required: sn_cimaf.sn_cimaf_admin or sn_reacf.sn_remedial_action_admin

Procedure

1. Open the Microsoft Endpoint Configuration Manager.
2. Create a MECM script with the name EndProcess.
   For more information, see Create a script in Microsoft Endpoint Configuration Manager.
3. Provide the following code in the script block.

   Param(
   [Parameter(Mandatory=$True)]
   [string]$process_id
   )
   Get-Process -Id $process_id | Stop-Process -Force -PassThru
   

4. Retrieve and copy the script GUID.
5. Open the MECM Action Configuration [sn_mecm_action_config] table.
   The MECM Action Configuration table displays the list of action configurations.
6. From the list of configurations, select and edit End Process.
7. In the Action input field, add the script GUID.
   
8. Click Save.