Powershell Wierdness

[BLooRT]

Is certbot starting up "Select Administrator: C:\WlNDOWS\System32\WindowsPowerShell\v1.0\Powershell.exe" every 20 minutes or so?

If so, the powershell window is popping up and down way to fast to read
but there are no commands showing up in the blue window.

[webprofusion]

Nope, by default it has a windows task scheduled twice per day which triggers "certbot renew". It does run via powershell but not every 20 mins.

I've definitely seen windows popup random powershell windows, no idea what does that. You could try to troubleshoot it via process monitor cmd.exe - CMD prompt window pops up and instantly disappears periodically - Super User

[rmbolger]

PowerShell windows popping up regularly in the context of your logged in user account is not normal and could be a sign of malware infection.

[webprofusion]

@rmbolger

could be a sign of malware infection.

yeah I should check that as well ..

[webprofusion]

For info, here is a capture from one of my servers (in this case hosted in AWS):

Not sure if any of these spawn a powershell window but I can see amazon has an agent running regularly, tailscale is flushing dns regularly. I guess if I did the same in an azure server I'd see some other variations.

[BLooRT]

Here's what i found. I mean it sounds legit. certbot is asking powershell to do a renew (if needed) twice per day. And for a moment, the blue powershell window pops onto the screen and disappears. A bit unnerving i would suspect for some folk. it is supposed to be hidden as i see in it's common line, but it isn't.

it's command is Powershell.exe -NoProfile -WindowStyle Hidden -Command "certbot renew"
in case you can't see in that image.

[Osiris]

@BLooRT

twice per day

That's not the same as:

@BLooRT

every 20 minutes or so

.

[BLooRT]

It might have been a coincidental non related bug, but powershell was firing off maybe not every 20 minutes, but certainly once per hour. maybe I was rebooting a lot while trying to figure it out, maybe that caused the event to re-trigger? Anyhow, sorry about raising the alarm like that, I'm new at this, and was a little stressed and confused, but thanks to your clear documentation, I managed to get it working, at least i'm fairly sure. it seems to trigger maybe twice per day now.