Windows 10: Powershell script running every 60 seconds

I have re-purposed an old Toshiba Satellite L650 laptop to stream media in my theatre room. I installed an SSD and reinstalled Windows 10.


I have noticed the fan speed would increase and decrease regularly even when I was not touching it. I checked Task Manager and CPU would go up and down at that time, understandably. I noticed Powershell was the culprit. I checked the Powershell event log and a number of entries are logged, something to do with networking, here are a few entries (I have exported more but am unable to attach a file here, the log is full of these events):


Why does this happen??? Seems like some network optimisation process is continually running.


Log Name: Windows PowerShell

Source: PowerShell

Date: 3/02/2019 9:26:11 AM

Event ID: 600

Task Category: Provider Lifecycle

Level: Information

Keywords: Classic

User: N/A

Computer: Lounge

Description:

Provider "Registry" is Started.



Details:

ProviderName=Registry

NewProviderState=Started



SequenceNumber=1



HostName=ConsoleHost

HostVersion=5.1.17763.134

HostId=1cd7df3b-dfea-4c73-b874-85d6b49c3f43

HostApplication=C:\Windows\System32\WindowsPowerShell\v1.0\/powershell.exe Set-NetTCPSetting -SettingName InternetCustom -Timestamps Enabled | out-file -encoding ASCII -filepath C:\Windows\system32\config\systemprofile\AppData\Roaming\pow\ps51eWf.txt

EngineVersion=

RunspaceId=

PipelineId=

CommandName=

CommandType=

ScriptName=

CommandPath=

CommandLine=

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

<System>

<Provider Name="PowerShell" />

<EventID Qualifiers="0">600</EventID>

<Level>4</Level>

<Task>6</Task>

<Keywords>0x80000000000000</Keywords>

<TimeCreated SystemTime="2019-02-02T22:26:11.776545300Z" />

<EventRecordID>42278</EventRecordID>

<Channel>Windows PowerShell</Channel>

<Computer>Lounge</Computer>

<Security />

</System>

<EventData>

<Data>Registry</Data>

<Data>Started</Data>

<Data> ProviderName=Registry

NewProviderState=Started



SequenceNumber=1



HostName=ConsoleHost

HostVersion=5.1.17763.134

HostId=1cd7df3b-dfea-4c73-b874-85d6b49c3f43

HostApplication=C:\Windows\System32\WindowsPowerShell\v1.0\/powershell.exe Set-NetTCPSetting -SettingName InternetCustom -Timestamps Enabled | out-file -encoding ASCII -filepath C:\Windows\system32\config\systemprofile\AppData\Roaming\pow\ps51eWf.txt

EngineVersion=

RunspaceId=

PipelineId=

CommandName=

CommandType=

ScriptName=

CommandPath=

CommandLine=</Data>

</EventData>

</Event>



Log Name: Windows PowerShell

Source: PowerShell

Date: 3/02/2019 9:26:15 AM

Event ID: 600

Task Category: Provider Lifecycle

Level: Information

Keywords: Classic

User: N/A

Computer: Lounge

Description:

Provider "Registry" is Started.



Details:

ProviderName=Registry

NewProviderState=Started



SequenceNumber=1



HostName=ConsoleHost

HostVersion=5.1.17763.134

HostId=dbe4f3b2-cd71-4c48-b3a0-9050e4f7f9a4

HostApplication=C:\Windows\System32\WindowsPowerShell\v1.0\/powershell.exe Set-NetTCPSetting -CongestionProvider 2 -SettingName InternetCustom | out-file -encoding ASCII -filepath C:\Windows\system32\config\systemprofile\AppData\Roaming\pow\psOpvCp.txt

EngineVersion=

RunspaceId=

PipelineId=

CommandName=

CommandType=

ScriptName=

CommandPath=

CommandLine=

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

<System>

<Provider Name="PowerShell" />

<EventID Qualifiers="0">600</EventID>

<Level>4</Level>

<Task>6</Task>

<Keywords>0x80000000000000</Keywords>

<TimeCreated SystemTime="2019-02-02T22:26:15.764983800Z" />

<EventRecordID>42286</EventRecordID>

<Channel>Windows PowerShell</Channel>

<Computer>Lounge</Computer>

<Security />

</System>

<EventData>

<Data>Registry</Data>

<Data>Started</Data>

<Data> ProviderName=Registry

NewProviderState=Started



SequenceNumber=1



HostName=ConsoleHost

HostVersion=5.1.17763.134

HostId=dbe4f3b2-cd71-4c48-b3a0-9050e4f7f9a4

HostApplication=C:\Windows\System32\WindowsPowerShell\v1.0\/powershell.exe Set-NetTCPSetting -CongestionProvider 2 -SettingName InternetCustom | out-file -encoding ASCII -filepath C:\Windows\system32\config\systemprofile\AppData\Roaming\pow\psOpvCp.txt

EngineVersion=

RunspaceId=

PipelineId=

CommandName=

CommandType=

ScriptName=

CommandPath=

CommandLine=</Data>

</EventData>

</Event>

:)

 

PowerShell script run - Cmdlets

As SQL-IP and Cosmos are still internal to Microsoft, I wonder why you are not simply contacting the person who provided you with the scripts.

For point 1: see PowerShell: Bypass ExecutionPolicy to run downloaded scripts

For point2: this is specific to the script: "Cosmos.Document" is probably in a module which is not found.

 

PowerShell script run - Cmdlets

Greetings - in the last month my role (support for Microsoft) has begun running database searches using PowerShell ISE - the procedure and software I was given by Microsoft to follow specified PowerShell ISE, not PowerShell. The first week or so the searches
seemed to run fine and I got good results returned. Then the searches stopped successfully executing. I got various error messages, or just illogical results, and so I tried reinstalling PowerShell a couple of times, with no success. On Friday 8/12 I upgraded
to Win10 Anniversary Ed. I still can't successfully run a PowerShell ISE search request. So, I'm hoping the Forum can help:

1. When I Run a request I get this pop-up: "Run only scripts that you trust. While scripts from the internet can be useful, this script can potentially harm your computer. If you trust this script, use the Unbock-File cmdlet to allow the script to run without
this warning message. Do you want to run ...". I then get 3 options 1) Do not run, 2) Run Once, 3) Suspend.

My understanding is that the "Unbock-File cmdlet" is a single-feature command that manipulates objects in Windows PowerShell. Where should I insert the "Unbock-File cmdlet" ? I trust the script because it was provided to me by Microsoft.

2. I've been selecting option 2) Run Once. The script will then run for a while, and then I get this error message "[Expression Error] The import Cosmos.Document matches no exports. Did you miss a module reference?"

How do resolve this issue? Reinstalling PowerShell has not seemed to help.

Any help much appreciated!

 

Run PowerShell Script As An Administrator


Hi. So I've been searching online on a way to do this yet I cannot find a way to do it.

_______________________________________

I need this in specific:

I want to double click a PowerShell script file (which will run as an administrator) from Windows Explorer that has this as the script:
Set-MpPreference -DisableRealtimeMonitoring $true

(that script requires that PowerShell needs to be run as an administrator)
_______________________________________

So those are the restrictions:
No right-click>run PowerShell as an administrator
No opening a shortcut to PowerShell (as an administrator) and pasting the command


Thanks