Forum Discussion
Microsoft EPM – Random CMD / PowerShell / OpenConsole popups
Hello everyone,
we are currently testing Microsoft Endpoint Privilege Management (EPM) and are seeing some unexpected behavior on several devices.
Symptoms
Users occasionally see random:
- CMD windows
- PowerShell windows
- OpenConsole windows
The windows usually appear shortly after logon and disappear automatically after a short time.
Some developers also reported issues related to:
- VS Code terminal integration
- Copilot terminal actions
- Windows Terminal
- WSL / Debian
Additional observations
- However, we have also seen PowerShell popups on a user who is not currently part of the EPM pilot group
- Some affected devices still have Admin By Request installed
Current EPM Configuration
At the moment we only have an Elevation Settings Policy assigned with User Confirmed enabled.
We currently do not have any custom elevation rules, file hash rules, publisher rules or automatic elevations configured.
The issue appears in a configuration that is essentially limited to:
- EPM client installed
- Elevation Settings Policy assigned
- User Confirmed elevation workflow enabled
This is one of the reasons why we are unsure whether the behavior is directly related to an EPM policy configuration or to an interaction between:
- EPM agent
- Windows Terminal / OpenConsole
- VS Code
- WSL
- Admin By Request
Questions
- Has anyone experienced random CMD / PowerShell / OpenConsole windows after introducing EPM?
- Has anyone seen issues between EPM and:
- Windows Terminal
- OpenConsole.exe
- VS Code terminal
- WSL
- Has anyone run Admin By Request and Microsoft EPM on the same device and observed unexpected console windows?
- Are there any EPM-specific logs that provide detailed parent/child process relationships for these launches?
Any ideas or similar experiences would be greatly appreciated.
Thanks!
3 Replies
Correlate the popup timestamp with process-creation events in Event Viewer and Intune Endpoint analytics. Review EPM elevation rules, path and hash conditions, and the execution user; compare a scoped audit-mode policy with the enforced policy. Do not grant broad elevation while the cause is unknown; send the device, policy ID, and timestamps to Microsoft Support.
Your setup has an Elevation Settings policy with User Confirmed enabled, yet consoles appear at sign-in and on a non-pilot device. An EPM-triggered launch is unproven: Microsoft documents User Confirmed elevation as starting through Run with elevated access, while assigning the settings policy installs the Microsoft EPM Agent service.
In Intune admin center, open Endpoint security > Endpoint Privilege Management > Reports > Elevation report. Filter by user, device, and popup time; it records file name, result, and timestamp, although processing can take 24 hours. On a test device, enable Audit Process Creation, reproduce the popup, and inspect Security event 4688 for the new process and creator process. Compare an EPM-only device, an Admin By Request-only device, and a coexistence device. If no matching EPM elevation exists, investigate its parent process. Microsoft does not document a compatibility conclusion for Admin By Request, VS Code, WSL, or OpenConsole from these symptoms.
The fact that a non-pilot user also sees the PowerShell popup means the evidence does not yet isolate EPM. Microsoft’s documentation does not identify an incompatibility with Windows Terminal, VS Code, WSL, or OpenConsole, so avoid treating EPM as the cause without a process trace. Start with one clean pilot device that has EPM enabled but Admin By Request removed, then reproduce after logon and record the exact time. In Intune, compare that time with Endpoint Privilege Management elevation reports; visibility depends on the reporting scope, and report processing can be delayed. If Defender for Endpoint is deployed, query DeviceProcessEvents for cmd.exe, powershell.exe, pwsh.exe, OpenConsole.exe, and wsl.exe around that time. The table exposes command lines, initiating processes, and parent-process fields, which should identify the launcher. Repeat on an EPM-free control device. If the parent chain points to an EPM component, collect Intune diagnostics and open a Microsoft support case.
