C# Powershell Execution Error (Script runs fine in Powershell)


Quick synopsis of issue: I have a Powershell script I downloaded off net which purpose allows me to supply a parameter named 'computername' with a value of comma delimited IP addresses to run netstat on the remote machines and return the values. When I execute this script from Powershell console it runs perfect. I Then down loaded example of execution of powershell script for C# and got it work on my local machine, but when I add the parameter of computername and supply list of addresses, it fails with RPC Server Unavailable error. The following is the Powershell script itself:

            Display current TCP/IP connections for local or remote system


            Display current TCP/IP connections for local or remote system.  Includes the process ID (PID) and process name for each connection.
            If the port is not yet established, the port number is shown as an asterisk (*).    

        .PARAMETER ProcessName
            Gets connections by the name of the process. The default value is '*'.

        .PARAMETER Port
            The port number of the local computer or remote computer. The default value is '*'.

        .PARAMETER Address
            Gets connections by the IP address of the connection, local or remote. Wildcard is supported. The default value is '*'.

        .PARAMETER Protocol
            The name of the protocol (TCP or UDP). The default value is '*' (all)

        .PARAMETER State
            Indicates the state of a TCP connection. The possible states are as follows:

            Closed       - The TCP connection is closed. 
            Close_Wait   - The local endpoint of the TCP connection is waiting for a connection termination request from the local user. 
            Closing      - The local endpoint of the TCP connection is waiting for an acknowledgement of the connection termination request sent previously. 
            Delete_Tcb   - The transmission control buffer (TCB) for the TCP connection is being deleted. 
            Established  - The TCP handshake is complete. The connection has been established and data can be sent. 
            Fin_Wait_1   - The local endpoint of the TCP connection is waiting for a connection termination request from the remote endpoint or for an acknowledgement of the connection termination request sent previously. 
            Fin_Wait_2   - The local endpoint of the TCP connection is waiting for a connection termination request from the remote endpoint. 
            Last_Ack     - The local endpoint of the TCP connection is waiting for the final acknowledgement of the connection termination request sent previously. 
            Listen       - The local endpoint of the TCP connection is listening for a connection request from any remote endpoint. 
            Syn_Received - The local endpoint of the TCP connection has sent and received a connection request and is waiting for an acknowledgment. 
            Syn_Sent     - The local endpoint of the TCP connection has sent the remote endpoint a segment header with the synchronize (SYN) control bit set and is waiting for a matching connection request. 
            Time_Wait    - The local endpoint of the TCP connection is waiting for enough time to pass to ensure that the remote endpoint received the acknowledgement of its connection termination request. 
            Unknown      - The TCP connection state is unknown.

            Values are based on the TcpState Enumeration:

            Cookie Monster - modified these to match netstat output per here:

        .PARAMETER ComputerName
            If defined, run this command on a remote system via WMI.  \\computername\c$\netstat.txt is created on that system and the results returned here

        .PARAMETER ShowHostNames
            If specified, will attempt to resolve local and remote addresses.

        .PARAMETER tempFile
            Temporary file to store results on remote system.  Must be relative to remote system (not a file share).  Default is "C:\netstat.txt"

        .PARAMETER AddressFamily
            Filter by IP Address family: IPv4, IPv6, or the default, * (both).

            If specified, we display any result where both the localaddress and the remoteaddress is in the address family.

            Get-NetworkStatistics | Format-Table

            Get-NetworkStatistics iexplore -computername k-it-thin-02 -ShowHostNames | Format-Table

            Get-NetworkStatistics -ProcessName md* -Protocol tcp

            Get-NetworkStatistics -Address 192* -State LISTENING

            Get-NetworkStatistics -State LISTENING -Protocol tcp

            Get-NetworkStatistics -Computername Computer1, Computer2

            'Computer1', 'Computer2' | Get-NetworkStatistics


            Author: Shay Levy, code butchered by Cookie Monster
            Shay's Blog: http://PowerShay.com
            Cookie Monster's Blog: http://ramblingcookiemonster.github.io/





                       ValueFromPipeline = $True,
                       ValueFromPipelineByPropertyName = $True)]




            [switch]$ShowProcessNames = $true,  

            [System.String]$TempFile = "C:\netstat.txt",

            [string]$AddressFamily = '*'

            #Define properties
                $properties = 'ComputerName','Protocol','LocalAddress','LocalPort','RemoteAddress','RemotePort','State','ProcessName','PID'

            #store hostnames in array for quick lookup
                $dnsCache = @{}



            foreach($Computer in $ComputerName) {

                #Collect processes
                    Try {
                        $processes = Get-Process -ComputerName $Computer -ErrorAction stop | select name, id
                    Catch {
                        Write-warning "Could not run Get-Process -computername $Computer.  Verify permissions and connectivity.  Defaulting to no ShowProcessNames"
                        $ShowProcessNames = $false

                #Handle remote systems
                    if($Computer -ne $env:COMPUTERNAME){

                        #define command
                            [string]$cmd = "cmd /c c:\windows\system32\netstat.exe -ano >> $tempFile"

                        #define remote file path - computername, drive, folder path
                            $remoteTempFile = "\\{0}\{1}`${2}" -f "$Computer", (split-path $tempFile -qualifier).TrimEnd(":"), (Split-Path $tempFile -noqualifier)

                        #delete previous results
                                $null = Invoke-WmiMethod -class Win32_process -name Create -ArgumentList "cmd /c del $tempFile" -ComputerName $Computer -ErrorAction stop
                                Write-Warning "Could not invoke create win32_process on $Computer to delete $tempfile"

                        #run command
                                $processID = (Invoke-WmiMethod -class Win32_process -name Create -ArgumentList $cmd -ComputerName $Computer -ErrorAction stop).processid
                                #If we didn't run netstat, break everything off
                                Throw $_

                        #wait for process to complete
                            while (
                                #This while should return true until the process completes
                                            get-process -id $processid -computername $Computer -ErrorAction Stop
                            ) {
                                start-sleep -seconds 2 

                        #gather results
                            if(test-path $remoteTempFile){

                                Try {
                                    $results = Get-Content $remoteTempFile | Select-String -Pattern '\s+(TCP|UDP)'
                                Catch {
                                    Throw "Could not get content from $remoteTempFile for results"

                                Remove-Item $remoteTempFile -force

                                Throw "'$tempFile' on $Computer converted to '$remoteTempFile'.  This path is not accessible from your system."
                        #gather results on local PC
                            $results = netstat -ano | Select-String -Pattern '\s+(TCP|UDP)'

                #initialize counter for progress
                    $totalCount = $results.count
                    $count = 0

                #Loop through each line of results    
                    foreach($result in $results) {

                        $item = $result.line.split(' ',[System.StringSplitOptions]::RemoveEmptyEntries)

                        if($item[1] -notmatch '^\[::'){

                            #parse the netstat line for local address and port
                                if (($la = $item[1] -as [ipaddress]).AddressFamily -eq 'InterNetworkV6'){
                                    $localAddress = $la.IPAddressToString
                                    $localPort = $item[1].split('\]:')[-1]
                                else {
                                    $localAddress = $item[1].split(':')[0]
                                    $localPort = $item[1].split(':')[-1]

                            #parse the netstat line for remote address and port
                                if (($ra = $item[2] -as [ipaddress]).AddressFamily -eq 'InterNetworkV6'){
                                    $remoteAddress = $ra.IPAddressToString
                                    $remotePort = $item[2].split('\]:')[-1]
                                else {
                                    $remoteAddress = $item[2].split(':')[0]
                                    $remotePort = $item[2].split(':')[-1]

                            #Filter IPv4/IPv6 if specified
                                if($AddressFamily -ne "*")
                                    if($AddressFamily -eq 'IPv4' -and $localAddress -match ':' -and $remoteAddress -match ':|\*' )
                                        #Both are IPv6, or ipv6 and listening, skip
                                        Write-Verbose "Filtered by AddressFamily:`n$result"
                                    elseif($AddressFamily -eq 'IPv6' -and $localAddress -notmatch ':' -and ( $remoteAddress -notmatch ':' -or $remoteAddress -match '*' ) )
                                        #Both are IPv4, or ipv4 and listening, skip
                                        Write-Verbose "Filtered by AddressFamily:`n$result"

                            #parse the netstat line for other properties
                                $procId = $item[-1]
                                $proto = $item[0]
                                $status = if($item[0] -eq 'tcp') {$item[3]} else {$null}    

                            #Filter the object
                                if($remotePort -notlike $Port -and $localPort -notlike $Port){
                                    write-verbose "remote $Remoteport local $localport port $port"
                                    Write-Verbose "Filtered by Port:`n$result"

                                if($remoteAddress -notlike $Address -and $localAddress -notlike $Address){
                                    Write-Verbose "Filtered by Address:`n$result"

                                if($status -notlike $State){
                                    Write-Verbose "Filtered by State:`n$result"

                                if($proto -notlike $Protocol){
                                    Write-Verbose "Filtered by Protocol:`n$result"

                            #Display progress bar prior to getting process name or host name
                                Write-Progress  -Activity "Resolving host and process names"`
                                    -Status "Resolving process ID $procId with remote address $remoteAddress and local address $localAddress"`
                                    -PercentComplete (( $count / $totalCount ) * 100)

                            #If we are running showprocessnames, get the matching name
                                if($ShowProcessNames -or $PSBoundParameters.ContainsKey -eq 'ProcessName'){

                                    #handle case where process spun up in the time between running get-process and running netstat
                                    if($procName = $processes | Where {$_.id -eq $procId} | select -ExpandProperty name ){ }
                                    else {$procName = "Unknown"}

                                else{$procName = "NA"}

                                if($procName -notlike $ProcessName){
                                    Write-Verbose "Filtered by ProcessName:`n$result"

                            #if the showhostnames switch is specified, try to map IP to hostname
                                    $tmpAddress = $null
                                        if($remoteAddress -eq "" -or $remoteAddress -eq ""){
                                            $remoteAddress = $Computer
                                        elseif($remoteAddress -match "\w"){

                                            #check with dns cache first
                                                if ($dnsCache.containskey( $remoteAddress)) {
                                                    $remoteAddress = $dnsCache[$remoteAddress]
                                                    write-verbose "using cached REMOTE '$remoteAddress'"
                                                    #if address isn't in the cache, resolve it and add it
                                                        $tmpAddress = $remoteAddress
                                                        $remoteAddress = [System.Net.DNS]::GetHostByAddress("$remoteAddress").hostname
                                                        $dnsCache.add($tmpAddress, $remoteAddress)
                                                        write-verbose "using non cached REMOTE '$remoteAddress`t$tmpAddress"
                                    catch{ }


                                        if($localAddress -eq "" -or $localAddress -eq ""){
                                            $localAddress = $Computer
                                        elseif($localAddress -match "\w"){
                                            #check with dns cache first
                                                    $localAddress = $dnsCache[$localAddress]
                                                    write-verbose "using cached LOCAL '$localAddress'"
                                                    #if address isn't in the cache, resolve it and add it
                                                        $tmpAddress = $localAddress
                                                        $localAddress = [System.Net.DNS]::GetHostByAddress("$localAddress").hostname
                                                        $dnsCache.add($localAddress, $tmpAddress)
                                                        write-verbose "using non cached LOCAL '$localAddress'`t'$tmpAddress'"
                                    catch{ }

                            #Write the object   
                                New-Object -TypeName PSObject -Property @{
                                    ComputerName = $Computer
                                    PID = $procId
                                    ProcessName = $procName
                                    Protocol = $proto
                                    LocalAddress = $localAddress
                                    LocalPort = $localPort
                                    RemoteAddress =$remoteAddress
                                    RemotePort = $remotePort
                                    State = $status
                                } | Select-Object -Property $properties                             

                            #Increment the progress counter

Here is the Powershell command I feed the above script (which is named Get-NetworkStatistics2.ps1)

    PS C:\Scripts> C:\Scripts\Get-NetworkStatistics2.ps1 -AddressFamily IPv4 -ComputerName,,,,,,,,,,,,,,,,,, | Format-Table -autosize >> "C:\scripts\201703041042.txt"

When I execute the command above it runs perfect and pipes the results to the file indicated at the end of the command.

Here is the C# Code for creating an exe to run this same bit:

    public void ExecuteSynchronously()
        string sTab = "\t";  //make a tab character for file line formatting

        //this will be my output file
        TextWriter oTxt = File.AppendText(@"C:\Clients\FOO\NetStats\PSDumps.txt");

        //here we read the script in from a file
        string sScript;
        TextReader oScript = File.OpenText(@"C:\Clients\FOO\Scripts\Get-NetworkStatistics2.ps1");
        sScript = oScript.ReadToEnd();
        //textreader cleanup
        oScript = null;

        using (PowerShell PowerShellInstance = PowerShell.Create())

            // use "AddScript" to add the contents of a script file to the end of the execution pipeline.
            // use "AddCommand" to add individual commands/cmdlets to the end of the execution pipeline.
            PowerShellInstance.AddScript(sScript); //add my script

            //add the list of computers
            PowerShellInstance.AddParameter("computername", ",,,,,,,,,,,,,,,,,,");

            //add the flag to say I am not interested in IPv6
            PowerShellInstance.AddParameter("AddressFamily", "IPv4");

            // invoke execution on the pipeline (collecting output)
            var PSOutput = PowerShellInstance.Invoke();

            // check the other output streams (for example, the error stream)
            if (PowerShellInstance.Streams.Error.Count > 0)
                //not done this yet : )
                // error records were written to the error stream.
                // do something with the items found.

            string sLine = "";

            //// loop through each output object item and build my own tab delimed file...
            foreach (PSObject outputItem in PSOutput)
                foreach (PSNoteProperty prop in outputItem.Properties)
                    if (prop.Value == null)
                        sLine += "" + sTab;
                        sLine += prop.Value.ToString() + sTab;

                sLine = sLine.Trim();
                sLine = "";

            //textwriter cleanup
            oTxt = null;

And finally... Here is the error message being produced by the C# executable.

    Unhandled Exception: System.Management.Automation.RuntimeException: The RPC serv
    er is unavailable. (Exception from HRESULT: 0x800706BA) ---> System.Runtime.Inte
    ropServices.COMException: The RPC server is unavailable. (Exception from HRESULT
    : 0x800706BA)
       at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 e
    rrorCode, IntPtr errorInfo)
       at System.Runtime.InteropServices.Marshal.ThrowExceptionForHR(Int32 errorCode
       at System.Management.ManagementScope.InitializeGuts(Object o)
       at System.Management.ManagementScope.Initialize()
       at System.Management.ManagementObject.Initialize(Boolean getObject)
       at System.Management.ManagementObject.GetMethodParameters(String methodName,
    ManagementBaseObject& inParameters, IWbemClassObjectFreeThreaded& inParametersCl
    ass, IWbemClassObjectFreeThreaded& outParametersClass)
       at System.Management.ManagementObject.GetMethodParameters(String methodName)
       at Microsoft.PowerShell.Commands.InvokeWmiMethod.ProcessRecord()
       --- End of inner exception stack trace ---
       at System.Management.Automation.Runspaces.PipelineBase.Invoke(IEnumerable inp
       at System.Management.Automation.PowerShell.Worker.ConstructPipelineAndDoWork(
    Runspace rs, Boolean performSyncInvoke)
       at System.Management.Automation.PowerShell.Worker.CreateRunspaceIfNeededAndDo
    Work(Runspace rsToUse, Boolean isSync)
       at System.Management.Automation.PowerShell.CoreInvokeHelper[TInput,TOutput](P
    SDataCollection`1 input, PSDataCollection`1 output, PSInvocationSettings setting
       at System.Management.Automation.PowerShell.CoreInvoke[TInput,TOutput](PSDataC
    ollection`1 input, PSDataCollection`1 output, PSInvocationSettings settings)
       at System.Management.Automation.PowerShell.CoreInvoke[TOutput](IEnumerable in
    put, PSDataCollection`1 output, PSInvocationSettings settings)
       at System.Management.Automation.PowerShell.Invoke(IEnumerable input, PSInvoca
    tionSettings settings)
       at System.Management.Automation.PowerShell.Invoke()
       at PowerShellExecutionSample.PowerShellExecutor.ExecuteSynchronously()
       at PowerShellExecutionSample.Program.Main(String[] args)        

Can anyone please explain how this works in Powershell on the same box I am attempting to run this on with my C# exe?

I should note, that I made a version that only run netstat on the local machine, and it worked fine and produced the file perfect.

Thanks very much in advance for any help you can provide.

asked on Stack Overflow Mar 4, 2017 by John Fischer • edited Mar 4, 2017 by John Fischer

1 Answer


Really I owe the props for this to @mklement0. He encouraged me to take a more simple approach at isolating the issue and that worked.

As I mentioned above in the question there was a parameter named "ComputerName". Running the script from the Powershell ISE using a comma delimeted string of values (even with comma + space) worked just fine. When I brought that over to the C# program to run it was not fine. So I took @mklement suggestion and plugged in a single remote IP and it worked just fine. At that point I knew the problem was in this area. I converted the string of IP addresses to an array, used the array as the ComputerName parameter value, and voila. it is working. I am pretty new at Powershell and not all that great at C# either. Thanks for the help and to those that read it.

answered on Stack Overflow Mar 4, 2017 by John Fischer

User contributions licensed under CC BY-SA 3.0