How to find out which script is being executed?

Mountain Pond 1,141 Reputation points
2022-09-02T21:14:57.527+00:00

Hi,
I'm sure a lot of people have had the same problem. When many scripts are running on a machine and there are times when one of the scripts creates a load on the processor or memory.

I need to find out what the script is. However, in the task manager, we can only observe powershell.exe processes, but it is not clear what script is being executed in this process.

Also Process Monitor and Process Explorer do not show the ps1 filename or path. Because the process is already running and powershell was reading and started executing the script.

If it is not possible to know which script is running. Perhaps there is a way to write processes ID to a log file. Is it possible to find out the ID of the powershell process that initialized the script? What would the script add to the log file, the ID of the process from which it started.

Thank you.

Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,116 questions
Windows 10 Security
Windows 10 Security
Windows 10: A Microsoft operating system that runs on personal computers and tablets.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
2,753 questions
Windows Server PowerShell
Windows Server PowerShell
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.PowerShell: A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
5,362 questions
0 comments
Accepted answer
  1. MotoX80 31,571 Reputation points
    2022-09-03T00:24:54.367+00:00

    Add command line to the task manger display.

    237481-image.png

    That will tell you the initiating script. If it calls other scripts, review the code or add a transcript to see what other scripts are being called.

    https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.host/start-transcript?view=powershell-5.1

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. JimmySalian-2011 41,916 Reputation points
    2022-09-02T21:40:23.813+00:00

    Hi Denis,

    Only setting I can recollect is the PS logging via the GPO, as you already tried procmon and proc explorer. about_logging_windows

    ==
    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.