0

From time to time a cmd windows popps up (or two of them) for a split second I cannot track what was started. Is there a way to monitor the cmd/powershell window? Sysmon?

Or is there a way to force cmd window to not close when command finishes?

The main issue is that I cannot see what command was started

closed as off-topic by Gerald Schneider, Andrew Schulman, Ward, TessellatingHeckler, yagmoth555 Mar 13 '18 at 0:10

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions on Server Fault must be about managing information technology systems in a business environment. Home and end-user computing questions may be asked on Super User, and questions about development, testing and development tools may be asked on Stack Overflow." – Gerald Schneider, Andrew Schulman, Ward
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Sysmon would work. An alternative would be procmon and keep it running until the window pops up. – Lieven Keersmaekers Mar 7 '18 at 7:22
  • Will it show me what command was started? – koller23 Mar 7 '18 at 7:23
  • Yes, both will. Sysmon shows it in the eventlog, procmon shows it in the process details. For a one of situation, procmon would be the easier choice. Do make sure you don't hang up your computer by letting the log grow to large. – Lieven Keersmaekers Mar 7 '18 at 7:24
2

For a one of situation, procmon would be the easiest choice enter image description here

  1. Disable the registry, file and network activity to minimize the amount of logging.
  2. Make sure the process activity is enabled
  3. start capturing and wait for the popup (end capturing once the popup has, well, popped up)
  4. double click the process
  5. get the command line
  • more than I wished for :) – koller23 Mar 7 '18 at 7:54
  • @koller23 - I'm curious what it is :). I remember a similar issue on my machine that turned out to be a Windows update problem (nothing to worry about but annoying). – Lieven Keersmaekers Mar 7 '18 at 8:25

Not the answer you're looking for? Browse other questions tagged or ask your own question.