Microsoft EPM – Random CMD / PowerShell / OpenConsole popups

Hello everyone,

we are currently testing Microsoft Endpoint Privilege Management (EPM) and are seeing some unexpected behavior on several devices.

Users occasionally see random:

The windows usually appear shortly after logon and disappear automatically after a short time.

Some developers also reported issues related to:

However, we have also seen PowerShell popups on a user who is not currently part of the EPM pilot group
Some affected devices still have Admin By Request installed

At the moment we only have an Elevation Settings Policy assigned with User Confirmed enabled.

We currently do not have any custom elevation rules, file hash rules, publisher rules or automatic elevations configured.

The issue appears in a configuration that is essentially limited to:

This is one of the reasons why we are unsure whether the behavior is directly related to an EPM policy configuration or to an interaction between:

Has anyone experienced random CMD / PowerShell / OpenConsole windows after introducing EPM?
Has anyone seen issues between EPM and:
- Windows Terminal
- OpenConsole.exe
- VS Code terminal
- WSL
Has anyone run Admin By Request and Microsoft EPM on the same device and observed unexpected console windows?
Are there any EPM-specific logs that provide detailed parent/child process relationships for these launches?

Any ideas or similar experiences would be greatly appreciated.

Thanks!

Forum Discussion