2

(After browsing the list of Stack Exchange communities, superuser seemed like the most fitting. Please tell me if this should belong elsewhere.

I also tried searching this community for similar questions, but could not find any. Please also tell me if I missed one that deals with the same issue.)

I have a Lenovo computer running Windows 10 Home. A while back I noticed that a .bat file would sometimes execute spontaneously. I notice it because a cmd prompt window pops up (in front of whatever I'm working with at the moment) and directly shuts down again, the way a .bat file does when it just executes commands/does whatever and there is no info to show to the user.

I noticed that there was a point in time when this started, but there was no obvious correlation with anything I installed around that time.

My question is this: is there a way to log which .bat files are executed (or similar)? Then I could, when I notice the cmd prompt popping up and disappearing I could just go into that log and see which files were recently executed.

tl;dr I am looking for a way to log all executions of .bat files, in order to identify an intermittently executing one.

Improve this question
5
  • Starting point potentially but you'll need to do more reading and digging on the specifics and then confirm it logs the batch script executions or whatever it is you see that makes the cmd window pop up. Please note that executable files, vb scripts, etc. can also launch cmd processes and make that window pop up. docs.microsoft.com/en-us/windows/device-security/auditing/…
    – Vomit IT - Chunky Mess Style
    Aug 27, 2017 at 14:05
  • Possible duplicate of Does Windows log programs that have been run/called?
    – Vomit IT - Chunky Mess Style
    Aug 27, 2017 at 14:07
  • 1
    If you have a rough idea when this might happen run Process Monitor [technet.microsoft.com/en-us/sysinternals/processmonitor.aspx]. This will tell you which process is the parent. You can filter it down to Process events and drop everything else. You only really want the tree view of processes initially.
    – HelpingHand
    Aug 27, 2017 at 14:26
  • To add to this suggestion, you could configure Process Monitor to only show when process are created, then leave it running until you observe the target process having started.
    – I say Reinstate Monica
    Aug 27, 2017 at 15:58
  • I just wanted to let everyone know that I am trying these different suggestions. However, I have not noticed the bat file executing during this time, which makes it hard to select an answer that solved my problem :-) When/if I find the bat file, I will follow up on this. In the meantime, thanks for all the great suggestions!
    – razofz
    Sep 19, 2017 at 9:29

2 Answers 2

Reset to default
0

This is likely the Office updater popping up.

First, open the Task Scheduler app as an administrator. The easiest method is to go to the Cortana search field and enter “Task Scheduler,” then right-click on the app and select “Run as administrator.”

Next, expand the Task Scheduler Library, and then Microsoft, and select Office.

Right-click on “OfficeBackgroundTaskHandlerRegistration” and select “Disable.”

See https://www.digitaltrends.com/computing/here-is-a-fix-for-microsoft-office-command-prompt-issue/

Improve this answer
0

You can query your task scheduler with this batch file :

@echo off 
schtasks /query | find /I /V "Microsoft" > "%temp%\tasks1.txt"
Type "%temp%\tasks1.txt" | find /I /V "N/A" > "%temp%\tasks2.txt"
Type "%temp%\tasks2.txt" | find /I /V "stat" > "%temp%\tasks3.txt"
Type "%temp%\tasks3.txt" | find /I /V "=" > "%temp%\tasks4.txt"
Type "%temp%\tasks4.txt" | find /I /V "INFORMATION" > "%temp%\tasks5.txt"
If exist c:\tasks.txt del c:\tasks.txt  
for /f "delims=" %%a in ('Type "%temp%\tasks5.txt"') do (
    echo %%a >>c:\tasks.txt
)
for /f "delims=" %%# in ('Dir /b /s "%temp%\tasks*"') do (
    Del "%%#">nul 2>&1
)
Start "" c:\tasks.txt
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .