Windows 10: Powershell command execution in the background

Hi,We can see powershell transcript generated however how can we find what process triggered that execution? It seems to be generated hourly. What can be seen in the transcript is that it is running "PS>Get-Process Select-Object -Property ProcessName"The transcript output as follow,=====================================********************** Windows PowerShell transcript start Start time: [starttime]Username: [username]RunAs User: [username] Configuration Name: Machine: [machine name] Microsoft Windows NT 6.2.9200.0 Host Application: --pid=27660 Process ID: 34296 PSVersion: [PS Version

:)

 

Most windows executable commands not recognized by CMD and PowerShell.

Out of nowhere commands which involve executables like explorer.exe, msedge.exe, mspaint.exe, where, etc. are not working in command prompt or PowerShell. The output of the command prompt seem to be quite simple:

```

C:\Users\grass>where

'where' is not recognized as an internal or external command,

operable program or batch file.



C:\Users\grass>explorer

'explorer' is not recognized as an internal or external command,

operable program or batch file.

```

I'm still able to call applications in the path, like: idea, code, adb, gcc, etc.

Some things also stopped working, and it looks relevant to this overall terminal issue:

• IntelliJ IDEA cannot launch its in-IDE terminal. In particular it cannot find PowerShell.
  
• I cannot run any windows executables from WSL2 environment.
  
• Oracle virtual box running UBUNTU LTE16.04 has issues syncing shared folders.
  

 

PowerShell instead of Commandline in Creators Update

Interestingly enough my personal laptop just got the update...and still has Command Prompt listed, not PowerShell...

Edit: Not that it matters...I use both regularly. *Toast :toast:

 

How to stop Powershell from executing remote commands

I didn't think that any of the built-in PowerShell tasks displayed any form of window. Is there an entry in Task scheduler's opening screen's Task status section at the time you saw the PS window?

Exactly where were you looking? At the bottom of the Event viewer window, what does it say for Log name & Source? Is it this? Log name - Windows PowerShell Source - PowerShell (PowerShell)

In each PS event's records, there is a line beginning HostApplication= and I think you are saying that there is no file path identified in that entry.

Please look up and down the list to see if there is an entry that identifies a file and path around the time you saw that window.

PowerShell does not, by default, execute remote commands. This is explained in Change PowerShell Script Execution Policy - TenForumsTutorials

Run a Windows Defender Quick scan. How to Scan with Windows Defender - TenForumsTutorials Best of luck, Denis