Add-Content appending variables to log file is adding a mystery question mark

wallst360 21 Reputation points

I am upgrading sysmon (uninstall old version then install new version) and logging more detailed output to a local log file in case it needs to be referenced. In the log, I'm writing the timestamp, the current version of sysmon detected, and the output from the uninstall.

$uninstall is the output you see in console (or what I captured from standard out) when running "sysmon.exe -u force" - I have omitted this part of the code from the snippet below:

System Monitor v11.10 - System activity monitor
Copyright (C) 2014-2020 Mark Russinovich and Thomas Garnier
Sysinternals -

Stopping sysmon..
sysmon stopped.
sysmon removed.
Stopping SysmonDrv.
SysmonDrv stopped.
SysmonDrv removed.
Removing service files.

When echoing the values for $sysmonVer and $uninstall, it shows exactly as you would expect to see (there is no question mark). However when I Add-Content them together in the Write-Log function, there is always a line with a question mark (?) inserted between them:

8/30/2022 8:37:15 PM
Detected Version: 14.0
System Monitor v11.10 - System activity monitor

I also have a similar $install log which has similar format to $uninstall and again it's just a capture of standard out. When this variable is also appended to the log via Add-Content it does not add a question mark and displays in the log as expected.

Not a showstopper by any means but I'm curious to know where the question mark (?) is coming from and how I can potentially eliminate it.

function Detect-Version {  
    $getService = Get-CimInstance -ClassName win32_service | ? {$_.Name -match '^sysmon[6]{0,1}[4]{0,1}$'}  
    if ($getService -eq $null) {$sysmonVer = 'NotDetected'}  
    if ($getService -ne $null) {  
        $sysmonVer = (Get-ChildItem -Path $getService.PathName).VersionInfo.FileVersion  
    return $sysmonVer  
function Write-Log {  
    $logFile = 'c:\temp\my.log'  
    $timeStamp = (Get-Date).ToString()  
    Add-Content -Path $logFile -Value $timeStamp  
    Add-Content -Path $logfile -Value "Detected Version: $($sysmonVer)"  
    Add-Content -Path $logFile -Value $uninstall  
$sysmonVer = Detect-Version  
Windows Server PowerShell
Windows Server PowerShell
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.PowerShell: A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
5,432 questions
0 comments No comments
{count} votes

Accepted answer
  1. Rich Matheisen 45,416 Reputation points

    Try adding "-Encoding UTF8" to each of the Add-Content cmdlets.

0 additional answers

Sort by: Most helpful