Who is Starting Hidden Programs?

by Jun 12, 2019

Ever wondered why your CPU load is so high at times, or why black windows open up for a split second? Then check your event log for program launches, and find out when and what was started automatically:

Get-EventLog -LogName System -InstanceId 1073748869 |
ForEach-Object {

    [PSCustomObject]@{
        Date = $_.TimeGenerated
        Name = $_.ReplacementStrings[0]
        Path = $_.ReplacementStrings[1]
        StartMode = $_.ReplacementStrings[3]
        User = $_.ReplacementStrings[4]


    }
}  | Out-GridView

Twitter This Tip! ReTweet this Tip!