Microsoft EPM – Random CMD / PowerShell / OpenConsole popups

The fact that a non-pilot user also sees the PowerShell popup means the evidence does not yet isolate EPM. Microsoft’s documentation does not identify an incompatibility with Windows Terminal, VS Code, WSL, or OpenConsole, so avoid treating EPM as the cause without a process trace. Start with one clean pilot device that has EPM enabled but Admin By Request removed, then reproduce after logon and record the exact time. In Intune, compare that time with Endpoint Privilege Management elevation reports; visibility depends on the reporting scope, and report processing can be delayed. If Defender for Endpoint is deployed, query DeviceProcessEvents for cmd.exe, powershell.exe, pwsh.exe, OpenConsole.exe, and wsl.exe around that time. The table exposes command lines, initiating processes, and parent-process fields, which should identify the launcher. Repeat on an EPM-free control device. If the parent chain points to an EPM component, collect Intune diagnostics and open a Microsoft support case.