how to stop windows shell popup

Question

get rid of this popup help

Answer 1

Hello Marie G,

That message is a built-in prompt from Microsoft that appears in Windows PowerShell 5.1 to encourage upgrading to the newer PowerShell 7. It is not a sign of anything wrong with your system.

There are two ways to get rid of it:

Option 1 — Suppress it without installing anything:

In Windows Terminal, go to Settings > Open JSON file and find the PowerShell profile entry. Add -NoLogo to the commandline field, so it looks something like: "commandline": "powershell.exe -NoLogo" Save the file, restart Windows Terminal, and the message will no longer appear.

Option 2 — Install PowerShell 7:

If you are open to upgrading, installing PowerShell 7 will remove the message permanently since it no longer applies. You can install it via the Microsoft Store by searching for PowerShell, or by running this in your current PowerShell window: winget install Microsoft.PowerShell .

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".  

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread. 

Answer 2

The screenshot shows Windows PowerShell opening in a terminal window. If it keeps popping up by itself, it is likely being launched by a startup entry, scheduled task, or similar. The following steps from a similar case can be used to track down and remove the cause.

1. Check the Run registry key
   1. Open Windows PowerShell as Administrator.
   2. Run:

            reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run
      

   3. Look for any entry that launches powershell.exe with parameters like -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command ... or a suspicious URL.
   4. If such an entry exists, remove it:

            reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "<SuspiciousName>" /f
      

2. Find what is launching PowerShell
   1. Still in the elevated PowerShell window, run:

            Get-CimInstance Win32_Process |
              Where-Object { $_.Name -like "powershell*" } |
              Select Name,ProcessId,ParentProcessId,CommandLine
      

   2. Note the ParentProcessId. If the parent is a service host for the Task Scheduler (for example svchost.exe -k netsvcs -s Schedule), a scheduled task is starting PowerShell.
3. Look for a malicious scheduled task
   1. Run:

            Get-ScheduledTask |
              ForEach-Object {
                foreach ($a in $_.Actions) {
                  "{0} | {1} {2}" -f ("$($_.TaskPath)$($_.TaskName)"), $a.Execute, $a.Arguments
                }
              }
      

   2. Review the output for tasks that execute powershell.exe with suspicious arguments such as ExecutionPolicy Bypass, WindowStyle Hidden, or iex(irm http://...).
   3. When a clearly suspicious task is identified, remove it (example):

            Unregister-ScheduledTask -TaskName "<SuspiciousTaskName>" -Confirm:$false
      

4. Check WMI persistence
   1. Run these commands to list WMI event consumers that might launch PowerShell:

            Get-WmiObject -Namespace root\subscription -Class __EventFilter
            Get-WmiObject -Namespace root\subscription -Class CommandLineEventConsumer
            Get-WmiObject -Namespace root\subscription -Class ActiveScriptEventConsumer
      

   2. Look for entries that run powershell.exe or contain suspicious URLs. Remove only clearly malicious entries.
5. Check Startup folders
   1. Open File Explorer and check:
      • %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup
      • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
   2. Delete any unexpected scripts (.ps1, .vbs, .bat) or shortcuts that launch PowerShell.
6. Verify that no unwanted PowerShell instances remain
   1. Run:

            Get-CimInstance Win32_Process |
              Where-Object { $_.Name -like "powershell*" } |
              Select Name,CommandLine
      

   2. Only the PowerShell window being used for troubleshooting should appear.

If any of the checks reveal clearly malicious entries (especially ones downloading from the internet), also run a full scan with Windows Security to ensure the system is clean.

---

References:

• Power shell open by itself and it says: Running the environment check. Please wait... License OK - Microsoft Q&A