How to find out which script is being executed?

Question

Hi,
I'm sure a lot of people have had the same problem. When many scripts are running on a machine and there are times when one of the scripts creates a load on the processor or memory.

I need to find out what the script is. However, in the task manager, we can only observe powershell.exe processes, but it is not clear what script is being executed in this process.

Also Process Monitor and Process Explorer do not show the ps1 filename or path. Because the process is already running and powershell was reading and started executing the script.

If it is not possible to know which script is running. Perhaps there is a way to write processes ID to a log file. Is it possible to find out the ID of the powershell process that initialized the script? What would the script add to the log file, the ID of the process from which it started.

Thank you.

Answer 1

Add command line to the task manger display.

That will tell you the initiating script. If it calls other scripts, review the code or add a transcript to see what other scripts are being called.

https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.host/start-transcript?view=powershell-5.1

Answer 2

Hi Denis,

Only setting I can recollect is the PS logging via the GPO, as you already tried procmon and proc explorer. about_logging_windows

==
Please "Accept the answer" if the information helped you. This will help us and others in the community as well.