0

From time to time a cmd windows popps up (or two of them) for a split second I cannot track what was started. Is there a way to monitor the cmd/powershell window? Sysmon?

Or is there a way to force cmd window to not close when command finishes?

The main issue is that I cannot see what command was started

Improve this question
3
  • 1
    Sysmon would work. An alternative would be procmon and keep it running until the window pops up.
    – Lieven Keersmaekers
    Mar 7, 2018 at 7:22
  • Will it show me what command was started?
    – kol23
    Mar 7, 2018 at 7:23
  • Yes, both will. Sysmon shows it in the eventlog, procmon shows it in the process details. For a one of situation, procmon would be the easier choice. Do make sure you don't hang up your computer by letting the log grow to large.
    – Lieven Keersmaekers
    Mar 7, 2018 at 7:24

1 Answer 1

Reset to default
2

For a one of situation, procmon would be the easiest choice enter image description here

  1. Disable the registry, file and network activity to minimize the amount of logging.
  2. Make sure the process activity is enabled
  3. start capturing and wait for the popup (end capturing once the popup has, well, popped up)
  4. double click the process
  5. get the command line
Improve this answer
2
  • more than I wished for :)
    – kol23
    Mar 7, 2018 at 7:54
  • @koller23 - I'm curious what it is :). I remember a similar issue on my machine that turned out to be a Windows update problem (nothing to worry about but annoying).
    – Lieven Keersmaekers
    Mar 7, 2018 at 8:25

Not the answer you're looking for? Browse other questions tagged .