1

I have a well-used four core developer machine running Windows 10 which has seen it's bit of software going in and out. Being a Java developer I am not that familiar with Windows 10 under the hood but I have local administrator rights.

I now have a PowerShell command which Task Manager reports running at 25% on a regular basis which cause my fans to run continuously, and Task Manager is as far as I can see only able to tell me about the PowerShell binary itself, but not the context it is running in which I think would help me identify which product invokes PowerShell and if it is legitimate or a left over from a not-quite-delete software installation.

Is there a way to have better information extracted from the running job, that can help me understand what it is doing?

  • the simplest - in my opinion - is to add Start-Transcript to the top of the scripts in question. the resulting logs will let you know the commands & times involved. i enabled powershell auditing in my Local Group Policy settings to log all of that sort of thing to a file in my Documents\Powershell dir. – Lee_Dailey Mar 26 at 12:48
  • @Lee_Dailey I had absolutely no idea which scripts were being run. – Thorbjørn Ravn Andersen Mar 26 at 14:07
  • ah! i misunderstood [blush] ... then do as my 2nd point mentioned and enable powershell auditing. – Lee_Dailey Mar 26 at 14:11
2

Use Process Explorer.

Locate the PowerShell process in the list and double-click it to see its properties. This will give details such as its command-line, parent process, environment and more. If you set the Lower Pane view to "Handles", you can also see used resources such as opened files.

|improve this answer|||||
  • Thank you. This allowed me to identify the culprit to a tool unknown to me, but known to operations as one responsible for rolling out updates. Apparently the "everybody work at home" require changes under the hood. After doing what operations told me and telling Windows to throttle the cpu under load things became a lot quieter! – Thorbjørn Ravn Andersen Mar 26 at 14:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.