Forum Discussion

silasst's avatar
silasst
Copper Contributor
Jul 20, 2026

Microsoft EPM – Random CMD / PowerShell / OpenConsole popups

Hello everyone,

we are currently testing Microsoft Endpoint Privilege Management (EPM) and are seeing some unexpected behavior on several devices.

Symptoms

Users occasionally see random:

  • CMD windows
  • PowerShell windows
  • OpenConsole windows

The windows usually appear shortly after logon and disappear automatically after a short time.

Some developers also reported issues related to:

  • VS Code terminal integration
  • Copilot terminal actions
  • Windows Terminal
  • WSL / Debian

Additional observations

  • However, we have also seen PowerShell popups on a user who is not currently part of the EPM pilot group
  • Some affected devices still have Admin By Request installed

Current EPM Configuration

At the moment we only have an Elevation Settings Policy assigned with User Confirmed enabled.

We currently do not have any custom elevation rules, file hash rules, publisher rules or automatic elevations configured.

The issue appears in a configuration that is essentially limited to:

  • EPM client installed
  • Elevation Settings Policy assigned
  • User Confirmed elevation workflow enabled

This is one of the reasons why we are unsure whether the behavior is directly related to an EPM policy configuration or to an interaction between:

  • EPM agent
  • Windows Terminal / OpenConsole
  • VS Code
  • WSL
  • Admin By Request

Questions

  1. Has anyone experienced random CMD / PowerShell / OpenConsole windows after introducing EPM?
  2. Has anyone seen issues between EPM and:
    • Windows Terminal
    • OpenConsole.exe
    • VS Code terminal
    • WSL
  3. Has anyone run Admin By Request and Microsoft EPM on the same device and observed unexpected console windows?
  4. Are there any EPM-specific logs that provide detailed parent/child process relationships for these launches?

Any ideas or similar experiences would be greatly appreciated.

Thanks!

Endpoint Privilege Management (EPM)
epm
intune

1 Reply

  • Jamony's avatar
    Jamony
    MCT
    Jul 22, 2026

    The fact that a non-pilot user also sees the PowerShell popup means the evidence does not yet isolate EPM. Microsoft’s documentation does not identify an incompatibility with Windows Terminal, VS Code, WSL, or OpenConsole, so avoid treating EPM as the cause without a process trace. Start with one clean pilot device that has EPM enabled but Admin By Request removed, then reproduce after logon and record the exact time. In Intune, compare that time with Endpoint Privilege Management elevation reports; visibility depends on the reporting scope, and report processing can be delayed. If Defender for Endpoint is deployed, query DeviceProcessEvents for cmd.exe, powershell.exe, pwsh.exe, OpenConsole.exe, and wsl.exe around that time. The table exposes command lines, initiating processes, and parent-process fields, which should identify the launcher. Repeat on an EPM-free control device. If the parent chain points to an EPM component, collect Intune diagnostics and open a Microsoft support case.