The current implementation of the win-def:process_test and the win-def:process58_test cannot collect certain processes (e.g. system, idle, csrss, etc.) because there are restrictions that prevent user-level code from accessing them (http://msdn.microsoft.com/en-us/library/windows/desktop/ms684320(v=vs.85).aspx). We should see if there is another api that we can use to access these processes. It also looks like these processes can be accessed with wmi and powershell.