Checked my event viewer to see if my system was starting any funny commands. This is due to the fact i noticed a sudden slowdown on my pc after startup.

Im wondering if an event like this is normal; Particularly im worried why it is an event executing powershell with 'ExecutionPolicy - Unrestricted'. This is the event viewer log:

Engine state is changed from Available to Stopped. 

Details:    NewEngineState=Stopped  PreviousEngineState=Available


    HostName=ConsoleHost    HostVersion=5.1.22621.963   HostId=0164a692-3bb4-4c12-a309-a980519310f6     HostApplication=**powershell.exe -NoLogo -NoProfile -InputFormat Text
-NoExit -ExecutionPolicy Unrestricted -Command -**  EngineVersion=5.1.22621.963     RunspaceId=703eb2af-1dc0-4686-97a5-15feaf371af3     PipelineId=     CommandName=    CommandType=    ScriptName=     CommandPath=    CommandLine=
  • 1
    "Does windows have any business executing a command like this on startup?" - Yes; There is nothing specifically malicious about launching PowerShell without a profile. Unless you analyze the script that is ran itself. Your event log isn't conclusive one way or another.
    – Ramhound
    Apr 11, 2023 at 17:33
  • If you post this type of text, please format it as code not as a > quote.
    – Tetsujin
    Apr 11, 2023 at 17:35
  • Hi RamHound, i was worried about the 'ExecutionPolicy Unrestricted' section. I am not well versed with powershell. Does this cmdlet apply allow unsigned scripts across the board or specific to script/application it is running for
    – N S
    Apr 11, 2023 at 17:42
  • @NS Please edit your question and add requested information or clarification to the question.
    – Bodo
    Apr 11, 2023 at 17:54
  • 1
    @NS - If you suspect an script is automatically ran at start-up then running Autoruns can help find it. However, if you can't determine what script is being ran, there might not be a script actually being ran.
    – Ramhound
    Apr 11, 2023 at 18:01


You must log in to answer this question.

Browse other questions tagged .