Windows PowerShell - Process exited with code 5 (0x00000005)

Question

Windows PowerShell - Process exited with code 5 (0x00000005)

Dean Egan 50

Hello,

We are seeing many different machines (Windows 10 and Windows 11) that are facing issues with Windows PowerShell

When someone tries to launch Windows PowerShell, the console opens to [Process exited with code 5 (0x00000005)]:

User's image

After further inspection of Event Viewer, many Engine Health errors occur wit "Settings: illegal characters in path"

User's image

Has anyone come across this issue before?

This is causing many downstream issues such as apps failing to install via intune.

This only happens with Powershell 5, PowerShell 7 works fine.

Kind Regards,

Dean

2 answers

Your answer

Answer 1

S.Sengupta 24,476 MVP

Error code 5 (0x00000005) typically indicates an "Access Denied" error in Windows. This suggests that PowerShell is failing to launch due to insufficient permissions or other access-related issues.

Right-click on PowerShell and choose "Run as Administrator."

If this works, it confirms a permissions issue.

Open Control Panel > User Accounts > Change User Account Control settings.

Try lowering the UAC level temporarily.

Open Command Prompt as admin and run sfc /scannow and hit the Enter button.

then: DISM /Online /Cleanup-Image /RestoreHealth and hit the Enter button.

Dean Egan 50 Reputation points

2024-08-05T09:01:34.9+00:00

hi @S.Sengupta

The issue occurs even if you open PS5 as admin.

Kind Regards,

Dean
Mithun Prakash 0 Reputation points

2024-08-05T13:20:13.9633333+00:00

We already tried this, no luck.

Answer 2

MotoX80 36,291

That image looks like Terminal, and not Powershell. Did you change some setting to launch Terminal instead of Powershell.exe? Can you just run Powershell?

User's image

Settings: illegal characters in path"

Assuming that error is referring to the system path environment variable, run this statement in pwsh and look for non-ascii characters in folder names.

($env:path).split(";") | sort-object

If you don't find anything, run process monitor and trace it.

https://learn.microsoft.com/en-us/sysinternals/downloads/procmon

Add a filter to trace powershell and windowsterminal.

User's image

Recreate the error and find where Terminal launches Powershell. Look at the command line that Powershell was launched with.

User's image

Look at the files that Powershell tries to read and look for strange characters.

User's image

Mithun Prakash 0 Reputation points

2024-08-05T13:00:53.3466667+00:00

Hi MotoX80,

I am one of the users impacted with this issue.

The PowerShell5 process doesn't even start. When we try to start though Terminal, we get this error "[process exited with code 5 (0x00000005)]

You can now close this terminal with Ctrl+D, or press Enter to restart."

If we try to open it as admin it just flashes away.

PS7 does work.
MotoX80 36,291 Reputation points

2024-08-05T20:46:03.8133333+00:00

Check your settings and set Terminal to Windows Console Host.

Then search for cmd and launch a command prompt.

It should be the non-tabbed window that looks like this. Then run "powershell /?".

If you don't get a good error message, just the 0x0000005 code, which I believe is an access denied, then try process monitor again and set filters for "process name begins with powershell" and "path contains powershell". See what that captures.
Mithun Prakash 0 Reputation points

2024-08-06T10:37:34.0733333+00:00

Tried the above but no output from cmd.
MotoX80 36,291 Reputation points

2024-08-06T12:29:17.0733333+00:00
I have no idea what you guys did. Going after common suspects... for an "access denied" issue, do you have any 3rd party antivirus or intrusion detection products installed that might block PS? What about Group Policy, were any new policies applied? Have you checked the Security event log? When did this issue start? Can you relate the start of the problem to some change that was made?

Are the sysadmins, security admins, active directory admins, desktop support admins, all in the loop on troubleshooting this problem?

Is PS getting loaded from the correct directory?

where.exe powershell cd C:\Windows\System32\WindowsPowerShell\v1.0\ powershell.exe /?

Did you try the procmon trace that I mentioned?
Mithun Prakash 0 Reputation points

2024-08-06T12:53:52.7233333+00:00

Yes, tried procmon but no process shows up for PowerShell.
Mithun Prakash 0 Reputation points

2024-08-06T14:37:25.59+00:00

We checked AV and LAPS solution removed it also tried the safe mode but same result.
We did push out some CIS policy via Intune as we are cloud only infra with no DC. Its only impacting a couple of laptops not all of them so it's not GPO.

As for the procmon the PowerShell does not even show up. On task manger it just flashes away.
MotoX80 36,291 Reputation points

2024-08-06T20:33:32.5233333+00:00

One would think that if some security mechanism is blocking PS, that it would record an event in some log somewhere.

I don't know if this helps, but here is a PS script that I called RecentEvents.ps1 which reads through all event logs and sorts by time of day. That saves time by eliminating all the clicking that it would take to look in every log using eventvwr.

https://learn.microsoft.com/en-us/answers/questions/1048935/eventid-28-error?orderby=oldest&page=2#answers

There could also be text based logs files, but that would depend on the software that you are running. You would have to search the disk and look for .txt and .log files that were recently updated.

In procmon, you could try to capture everything. In the filter menu, uncheck the 2 entries that I replied about and also uncheck the entry that excludes the system process. Something in the trace should refer to "powershell". Search for that.

Can you open the powershell.exe file with notepad? It won't be readable except for some strings, but that might prove that something is blocking access to the file itself.

Share via

Windows PowerShell - Process exited with code 5 (0x00000005)

2 answers

Your answer