Frequent Unknown PowerShell Events

Question

Hello,

I'm using a new PC and noticed that my cursor displays the loading icon (spinning blue circle) for several seconds every few minutes. Task Manager didn't show any processes obviously spiking during that time, so I checked Task Scheduler and Event Viewer as well. No scheduled tasks seem to be running that frequently and I don't see any related Application/System events, though the PowerShell events include a pattern of events being run at the exact times I see the cursor change. Every 5-6 minutes, providers are started for Registry, Alias, Environment, FileSystem, Function, and Variable, and then the engine stops. The HostApplication is consistent every time this occurs.

HostApplication=C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /C Get-AppxPackage | Select Name

I've run a full Windows Defender scan and sfc /scannow and both reported no issues. I've also uninstalled Gigabyte Control Center and Copilot and neither of those helped. How can I determine what's causing these events? Even if it's not a cause for concern, the cursor constantly switching to the loading icon has already gotten annoying.

Thank you!

Answer 1

Hi, good day!

• When was the last time it worked properly?
• Have you made any changes to your computer recently?

---

That PowerShell command itself is usually harmless. The important part is figuring out what’s launching PowerShell every 5–6 minutes.

The easiest way to trace it is with Process Explorer from Microsoft:

https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer?utm_source=chatgpt.com

Run it as Administrator

Press Ctrl + F and search for powershell.exe

Wait for the loading cursor issue to happen

Check the parent process of PowerShell

That usually points directly to the culprit (OEM software, Widgets, Xbox services, shell extensions, etc.).

You can also perform a Clean Boot of Windows

Determine whether a background program or a software conflict is causing the issue.

Press Windows key+R to open Run then type: msconfig

Press Enter

Select System Configuration > go to the Services tab.

(Important) Select and make sure to put a check mark on "Hide all Microsoft services"

Click Disable all.

Go to Startup tab > Open Task Manager > Disable all the unnecessary services running there. Restart your computer.

Please check the support article at the link below for more details.

https://support.microsoft.com/en-us/topic/how-to-perform-a-clean-boot-in-windows-da2f9573-6eec-00ad-2f8a-a97a1807f3dd#ID0EBBD=Windows_11&id0ebbd=windows_10

I look forward to your update and am happy to continue working with you until the issue is resolved. If you find the answer helpful, please click "Accept Answer" and consider upvoting it. Otherwise, please keep me posted by clicking "Add comment" below instead of selecting Yes or No.

Answer 2

hi SPENCER JONAS,
The PowerShell command shown there:

Get-AppxPackage | Select Name

is commonly used by inventory/telemetry/background management software to enumerate installed apps. Since it is running every 5–6 minutes with the same HostApplication, something in the background is repeatedly querying installed AppX packages.

Because:

• the cursor briefly shows busy,

Task Manager shows no major CPU spike,

and the PowerShell engine starts/stops repeatedly,

this is likely not malware, but rather:

OEM utilities,

device management software,

security software,

widgets/Copilot integrations,

or Windows components polling installed apps.

You already removed Gigabyte Control Center and Copilot, which was a good test.

A few additional ways to trace the source:

Use Process Explorer (Sysinternals) and watch:

parent process of powershell.exe

Enable:

   Get-WinEvent -LogName Microsoft-Windows-PowerShell/Operational

and check ParentProcessId / execution context.

Check Task Scheduler for:

  hidden tasks
  
     especially under:
     
           Microsoft
           
                 Windows
                 
                       Application Experience
                       
                             Windows Update
                             
                                   Device Setup
                                   
                                   Perform a Clean Boot:
                                   
                                   ```
                                   msconfig
                                   ```
                                   
                                   to isolate third-party background services.
                                   

The good sign is that:

Defender scan,

SFC,

and Event Viewer show no corruption or failures.

So this currently looks more like an overly aggressive background polling task than an actual system problem.
If my answer is useful for you, please hit Accept the answer to support me.

Thank you so much,