Determine what program opened by itself then closed too quickly

https://learn.microsoft.com/en-us/sy...wnloads/sysmon

Do you have any scheduled tasks that might do this?

Note when it occurs and check the timing of those. Nirsoft's Taskschedulerview (free) lets you see a linear list of tasks which you can sort and order using the column headers, for example.

Could be a command line or a bat file...

Of course you could try a process of elimination by reviewing your startups.
Try Autoruns (free from MS) which lists every startup, including scheduled tasks.
Start with the less common ones.

OneDrive updates do this

CMD console is keys to the city though if you see them pop up then it is worth investigating, it could be anything a Microsoft automation or task will utilize cmd or ps silently in the background so that the user never sees the window, not always but usually majority of the time they are hidden.

if you can visually see a console popup and then closed its less seamless and further in it means that a command ran or potentially ran.

If it happens at login or not long after you first log in then you know its a good indication of something that is probably a scheduled task set to run after startup.

if its something that happens like clockwork as in you see it around the same times daily or something then its still probably a scheduled task.

if its random then more likely something else is running it.

Been a while since i used Sysmon i recall it can show you when something like a CMD console runs and what command/s run in that window. I cannot recall if it shows which process ran another process but i think it should be capable here too. I don't have it enabled atm, and not time to look either.

At least you can use it to see the former and the use that information and the other information in here for process of elimination.

davidhelp said:

I see on occasion a black command prompt window pop up and disappear in a second.
I have no idea what program does this.
Question: Is there a way to figure out what opened and closed so quickly?

Windows 10 Pro 22H2

The only real way to find out, is to take a screen shot.
It's very hard to do... especially when command prompt windows pop up intermittently.

But if you're fast... fast as an old west gunslinger, you may luck out.

davidhelp said:

Task Manager shows

davidhelp said:

Task Scheduler Library

David,

You are looking in the wrong places.

You need to examine the entries in
Task scheduler.
Task scheduler (Local),
Task status section.

You need to double-click on the entries & drag the column dividers to the right to see the times in full and then compare them to the list you must make of the times you saw the windows.


Best of luck,
Denis

The freeware program I suggested above gives you an easy list of when tasks were run:


You need to work logically and in an orderly manner to exclude possible causes - and make sure you can restore your normal settings after disabling things for test purposes.

E.g. by creating a System Restore point before starting.

Autoruns (free from MS) gives ALL startups including scheduled tasks with checkbox for disabling them.